# Logstash subtracting 1 hour from time field **URL:** \ **Category:** Logstash\ **Created:** [September 15, 2017, 7:03am UTC](https://discuss.elastic.co/t/logstash-subtracting-1-hour-from-time-field/100647 "2017-09-15T07:03:16Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![patrickian](https://avatars.discourse-cdn.com/v4/letter/p/c57346/32.png) [@patrickian](https://discuss.elastic.co/u/patrickian)\ **Post date:** [September 15, 2017, 7:03am UTC](https://discuss.elastic.co/t/logstash-subtracting-1-hour-from-time-field/100647/1 "2017-09-15T07:03:16Z")
I have a source text in string like this: 09/15/2017 14:50:09.866800 Let's call this field action\_end\_raw. I use a date filter to parse it to a date time: > date { > match =\> ["action\_end\_raw", "MM/dd/yyyy HH:mm:ss.SSSSSS"] > target =\> "action\_end" > remove\_field =\> ["action\_end\_raw"] > } However, when I check the action\_end field in the final log, it looks something like this: 2017-09-15T05:50:09.866Z and the timestamp looks like: 2017-09-15T06:50:14.047Z I would have expected timestamp and action\_end to be very close together. Now as far as I know, logstash converts them based on timezones. My server is in UTC+8 (Ulaanbataar), The client that sent the log is in UTC+8 (Hong Kong) and the machine I use to view is in UTC+8 (Hong Kong). Ulaanbataar's next adjustment should be after 2020, according to my research. I was curious, what could have happened? It was working properly before. Thanks in advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 13, 2017, 7:03am UTC](https://discuss.elastic.co/t/logstash-subtracting-1-hour-from-time-field/100647/2 "2017-10-13T07:03:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.