# Logstash Timezone Bug

**URL:** https://discuss.elastic.co/t/logstash-timezone-bug/161849
**Category:** Logstash
**Created:** [December 21, 2018, 1:12pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849 "2018-12-21T13:12:39Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Nelson\_Ferreira\_Juni](https://avatars.discourse-cdn.com/v4/letter/n/5e9695/32.png) [@Nelson\_Ferreira\_Juni](https://discuss.elastic.co/u/Nelson_Ferreira_Juni)
#### Post date: [December 21, 2018, 1:12pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/1 "2018-12-21T13:12:39Z")

</div>

I'm running logstash 6.5 inside a container (sebp/elk:650), this container is in the UTC timezone.  
The host machine is in the America/New\_York timezone, this is my Logstash configuration for the timezone:

date {  
match =\> ["timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]  
target =\> "@timestamp"  
timezone =\> "UTC"   
add\_field =\> { "debug" =\> "timestampMatched"}  
}

The time is being matched, but what is weird is that the Logstash inside the container is always considering UTC time as the Host machine time (America/New\_York), it simply doesn't convert the logs time to UTC.  
I was just able to fix it changing the Logstash timezone to match the host:  
timezone =\> "America/New\_York"even tried before changing the container timezone to match the host machine (America/New\_York), but Logstash inside the container kept considering UTC as America/New\_York time.

I know that Logstash should always store logs in UTC timezone, so I would like to have your help on this.

Thanks

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 21, 2018, 1:15pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/2 "2018-12-21T13:15:00Z")

</div>

The timezone parameter here tells Logstash that the timestamps being parsed are in UTC time. As the filter always parses into UTC, the generated timestamp should be the same as the one passed in.

---

<div class="post-metadata">

### Author: ![Nelson\_Ferreira\_Juni](https://avatars.discourse-cdn.com/v4/letter/n/5e9695/32.png) [@Nelson\_Ferreira\_Juni](https://discuss.elastic.co/u/Nelson_Ferreira_Juni)
#### Post date: [December 21, 2018, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/3 "2018-12-21T13:16:47Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> are in UTC time

So is this correct for me seetting it as:  
timezone =\> "America/New\_York" (It's working like this)

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 21, 2018, 1:21pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/4 "2018-12-21T13:21:13Z")

</div>

If the timestamps being parsed are in that timezone that is correct.

---

<div class="post-metadata">

### Author: ![Nelson\_Ferreira\_Juni](https://avatars.discourse-cdn.com/v4/letter/n/5e9695/32.png) [@Nelson\_Ferreira\_Juni](https://discuss.elastic.co/u/Nelson_Ferreira_Juni)
#### Post date: [December 21, 2018, 1:22pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/5 "2018-12-21T13:22:16Z")

</div>

Ok, thank you very much Christian!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2019, 1:22pm UTC](https://discuss.elastic.co/t/logstash-timezone-bug/161849/6 "2019-01-18T13:22:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
