# Logstash Output to Elasticsearch Timezone

**URL:** https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296
**Category:** Logstash
**Created:** [July 24, 2017, 9:38am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296 "2017-07-24T09:38:10Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [July 24, 2017, 9:38am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/1 "2017-07-24T09:38:10Z")

</div>

This is my output snippet.

```
output {
 elasticsearch {
  hosts => "localhost"
  index => "logstash-%{+YYYY.MM.dd}"
 }
 stdout {
  codec => rubydebug
 }
}

```

On my index, I got the index of the next day. So i don have 2 index in the same day.  
As what i've read the some other post, it is because of the UTC standard of the logstash.  
Is there a way to adjust the timezone of the output index. For ex. timezone =\> MNL/PHL

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 26, 2017, 5:50am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/2 "2017-07-26T05:50:45Z")

</div>

You could create another field with the date in your local timezone and reference that field in the `index` option.

Why does this even matter?

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [July 26, 2017, 7:40am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/3 "2017-07-26T07:40:44Z")

</div>

> You could create another field with the date in your local timezone and reference that field in the index option.

For example I have a field in my data which is @timestamp, therefore can I use this field?

```
output {
 elasticsearch {
  hosts => "localhost"
  index => "logstash-%{@timestamp}"
 }
 stdout {
  codec => rubydebug
 }
}

```

> Why does this even matter?

For me to check if there's data stored in my server in the specific date. Or I can check today if there's data today.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 26, 2017, 8:14am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/4 "2017-07-26T08:14:43Z")

</div>

> For example I have a field in my data which is @timestamp, therefore can I use this field?

No, `@timestamp` is UTC so you can't use it without converting its value into a date string in the local timezone. That could be done with a ruby filter. I don't have details handy so you'll have to do some digging.

> For me to check if there's data stored in my server in the specific date. Or I can check today if there's data today.

Just include the desired date range in your ES query instead.

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [July 26, 2017, 8:17am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/5 "2017-07-26T08:17:08Z")

</div>

Noted @magnusbaeck. Thank you very much! 👍

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2017, 8:17am UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-timezone/94296/6 "2017-08-23T08:17:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
