# Logstash mapping logfile time to @timestamp **URL:** \ **Category:** Logstash\ **Created:** [July 15, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772 "2021-07-15T11:23:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Vajb12](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Post date:** [July 15, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/1 "2021-07-15T11:23:37Z")
Hi Team, Im trying to map the logfile time with @timestamp in logstash. The logfile time is in IST. I would require some help in converting the logfile time to UTC and map it to @timestamp. I used the below ruby code to change the log file time to UTC. ruby { code =\> "event.set( 'logts' , Time.now.utc)" } if [logts] { date { match =\> ["logts", "ISO8601"] target =\> ["@timestamp"] #target =\> ["logts"] } } since i have used Time.now.utc, it converts all the logtime (logts) to current utc time. Which is incorrect. Can you please help in solving the above issue. Any help on this is much appreciated. Thanks in Advance. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 15, 2021, 12:38pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/2 "2021-07-15T12:38:49Z")
Please, share an example of your log with the time field. You don't need to use ruby to create a field with the UTC time, if your time field in your log is in another timezone you can use the `timezone` option of the `date` filter. ---
**Author:** ![Vajb12](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Post date:** [July 15, 2021, 1:06pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/3 "2021-07-15T13:06:57Z")
@leandrojmp Thanks a lot for your response. Below is an example of the my log with time field `"message":" [ERROR] **2021-07-13T19:43:44.552** [http-nio2-8080-exec-1092] amrwebdeployment-5cb5b4f68b-2zh4z - [i.i.i.a.f.AuthorizationFilter] :: The classmap is not loaded for the ITDRuntimeException with error code: AMR-RUNTIME-MS-9021 "` The grok filter which Im using to filter the above data is > grok { match =\> { "mesg" =\> ["^\s?[%{DATA:loglevel}] %{TIMESTAMP\_ISO8601:logts} [%{DATA:threadname}] %{DATA:podname} %{DATA:filler1} [%{DATA:classname}] %{GREEDYDATA:fullmesg}"] } } The logfile time is in IST timing and I want to set/map logts time to the @timestamp ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 15, 2021, 3:29pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/4 "2021-07-15T15:29:01Z")
You can use the `timezone` option in the `date` filter. Remove your ruby filter as it is just override the `logts` field with the current `utc` time and try this filter. ```auto date { match => ["logts", "ISO8601"] timezone => "your/timezone" } ``` `IST` is ambiguous, it could mean `India Standard Time`, `Irish Standard Time` or `Israel Standar Time`, you need the name of the timezone you are, which would be `Asia/Kolkata`, `Europe/Dublin` or `Asia/Jerusalem` for each one of those cases. In the case `IST` means `India Standard Time` you would use: ```auto date { match => ["logts", "ISO8601"] timezone => "Asia/Kolkata" } ``` ---
**Author:** ![Vajb12](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vajb12](https://discuss.elastic.co/u/Vajb12)\ **Post date:** [July 16, 2021, 3:46am UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/5 "2021-07-16T03:46:39Z")
@leandrojmp - The log time I meant IST was Indian standard time. Before using the ruby code, I first used the timezone option only. I tried two time zone options. when I set the timezone =\> "Asia/Kolkata" in the date filter, the resulting date (log date) in kibana seems to show a future date. When I set the timezone =\> "UTC " in the Date filter, same behaviour is observed. Hence I went with the Ruby filter . Please suggest. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 16, 2021, 5:11pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/6 "2021-07-16T17:11:18Z")
There is not much to suggest. If your date is in the `Asia/Kolkata` timezone, then you need to tell that to the date filter, so it will convert correctly to the UTC time as elasticsearch only stores date in UTC. What is the timezone of the machine running Kibana? Kibana per default will convert the UTC times to the browser timezone, which will use the time zone of the operating system. You can change this behavior in Kibana going into `Stack Management > Kibana Advanced Settings > Timezone for date formatting`, there you can choose which timezone Kibana should use. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 13, 2021, 5:11pm UTC](https://discuss.elastic.co/t/logstash-mapping-logfile-time-to-timestamp/278772/7 "2021-08-13T17:11:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.