You can use the timezone
option in the date
filter.
Remove your ruby filter as it is just override the logts
field with the current utc
time and try this filter.
date {
match => ["logts", "ISO8601"]
timezone => "your/timezone"
}
IST
is ambiguous, it could mean India Standard Time
, Irish Standard Time
or Israel Standar Time
, you need the name of the timezone you are, which would be Asia/Kolkata
, Europe/Dublin
or Asia/Jerusalem
for each one of those cases.
In the case IST
means India Standard Time
you would use:
date {
match => ["logts", "ISO8601"]
timezone => "Asia/Kolkata"
}