# Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day\_)

**URL:** https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781
**Category:** Beats
**Tags:** filebeat
**Created:** [April 27, 2017, 1:23am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781 "2017-04-27T01:23:37Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)
#### Post date: [April 27, 2017, 1:23am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/1 "2017-04-27T01:23:37Z")

</div>

below info is my logstash conf

can i define index name timezone ??

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %{DATA:domain} %{NUMBER:nb1} %{NUMBER:nb2} " }  
}  
date {  
locale =\> "en"  
match =\> ["datatime","YYYY-MM-dd HH:mm:ss"]  
timezone =\> "Asia/Shanghai"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["18.41.15.14:9200","18.41.15.15:9200"]  
index =\> "logstash-%{[fields][logtype]}-%{+YYYY.MM.dd}"

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 27, 2017, 1:30am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/2 "2017-04-27T01:30:18Z")

</div>

ES stores data in UTC, so that'd probably explain it.

---

<div class="post-metadata">

### Author: ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)
#### Post date: [April 27, 2017, 2:27am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/3 "2017-04-27T02:27:46Z")

</div>

> [@warkolm](#):
>
> so that'd probably explain it

how can i do it ? thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 27, 2017, 3:17am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/4 "2017-04-27T03:17:20Z")

</div>

Do what?

---

<div class="post-metadata">

### Author: ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)
#### Post date: [April 27, 2017, 3:19am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/5 "2017-04-27T03:19:51Z")

</div>

define index name datetime format and timezone

eg:  
logstash-field-logtype-201704.01(the datetime ' timezone)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 27, 2017, 3:20am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/6 "2017-04-27T03:20:40Z")

</div>

You cannot, ES uses UTC.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2017, 3:31am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781/7 "2017-05-25T03:31:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.