# Logstash output plugin index time zone problems

**URL:** <https://discuss.elastic.co/t/logstash-output-plugin-index-time-zone-problems/157917>\
**Category:** Logstash\
**Created:** [November 22, 2018, 4:37pm UTC](https://discuss.elastic.co/t/logstash-output-plugin-index-time-zone-problems/157917 "2018-11-22T16:37:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![maghibus](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@maghibus](https://discuss.elastic.co/u/maghibus)\
**Post date:** [November 22, 2018, 4:37pm UTC](https://discuss.elastic.co/t/logstash-output-plugin-index-time-zone-problems/157917/1 "2018-11-22T16:37:19Z")

</div>

Hi,

Take for example a log file with the following content:

```
2018-11-15 00:58:15,417 INFO [org.alfresco.solr.component.AsyncBuildSuggestComponent] Building suggester index for: shingleBasedSuggestions
2018-11-15 01:58:15,417 INFO [org.alfresco.solr.component.AsyncBuildSuggestComponent] Building suggester index for: shingleBasedSuggestions

```

My time zone is **Europe/Rome** (CET) and this is my Logstash configuration:

filter plugin:

```
 filter {
   grok {
     match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity}%{SPACE}*%{SYSLOG5424SD}" }
   }
   if "_grokparsefailure" in [tags] { drop {} }
   date { 
     match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"] remove_field => ["timestamp"] }
   }
}    

```

output plugin:

```
elasticsearch {
   hosts => ["localhost"]
   manage_template => false
   index => "solr-%{+YYYY.MM.dd}"
}

```

Logstash creates two indecis:

- solr-2018.11.14

> 2018-11-15 00:58:15,417 INFO [org.alfresco.solr.component.AsyncBuildSuggestComponent] Building suggester index for: shingleBasedSuggestions

- solr-2018.11.15

> 2018-11-15 01:58:15,417 INFO [org.alfresco.solr.component.AsyncBuildSuggestComponent] Building suggester index for: shingleBasedSuggestions

How can I avoid that scenario?  
What is the best scenario?

Thaks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2018, 4:46pm UTC](https://discuss.elastic.co/t/logstash-output-plugin-index-time-zone-problems/157917/2 "2018-12-20T16:46:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.