Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day_)

Elastic Stack Beats
1

below info is my logstash conf

can i define index name timezone ??

filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %{DATA:domain} %{NUMBER:nb1} %{NUMBER:nb2} " }
}
date {
locale => "en"
match => ["datatime","YYYY-MM-dd HH:mm:ss"]
timezone => "Asia/Shanghai"
}
}
output {
elasticsearch {
hosts => ["18.41.15.14:9200","18.41.15.15:9200"]
index => "logstash-%{[fields][logtype]}-%{+YYYY.MM.dd}"

2

ES stores data in UTC, so that'd probably explain it.

3

how can i do it ? thanks

4

Do what?

5

define index name datetime format and timezone

eg:
logstash-field-logtype-201704.01(the datetime ' timezone)

6

You cannot, ES uses UTC.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.