Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day_)

below info is my logstash conf

can i define index name timezone ??

filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %{DATA:domain} %{NUMBER:nb1} %{NUMBER:nb2} " }
date {
locale => "en"
match => ["datatime","YYYY-MM-dd HH:mm:ss"]
timezone => "Asia/Shanghai"
output {
elasticsearch {
hosts => ["",""]
index => "logstash-%{[fields][logtype]}-%{+YYYY.MM.dd}"

ES stores data in UTC, so that'd probably explain it.

how can i do it ? thanks

Do what?

define index name datetime format and timezone

logstash-field-logtype-201704.01(the datetime ' timezone)

You cannot, ES uses UTC.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.