Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day_)


(Champion Xie) #1

below info is my logstash conf

can i define index name timezone ??

filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %{DATA:domain} %{NUMBER:nb1} %{NUMBER:nb2} " }
}
date {
locale => "en"
match => ["datatime","YYYY-MM-dd HH:mm:ss"]
timezone => "Asia/Shanghai"
}
}
output {
elasticsearch {
hosts => ["18.41.15.14:9200","18.41.15.15:9200"]
index => "logstash-%{[fields][logtype]}-%{+YYYY.MM.dd}"


(Mark Walkom) #2

ES stores data in UTC, so that'd probably explain it.


(Champion Xie) #3

how can i do it ? thanks


(Mark Walkom) #4

Do what?


(Champion Xie) #5

define index name datetime format and timezone

eg:
logstash-field-logtype-201704.01(the datetime ' timezone)


(Mark Walkom) #6

You cannot, ES uses UTC.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.