Modifying the timestamp

Elastic Stack Logstash
1

I've got a filebeat daemon outputting logs to my redis server. My logstash is getting the input from redis and the timestamps are looking like this: "2016-07-07T23:49:19.882Z". I'm trying to modify it with this logstash filter but can't seem to make it work.

  filter{
      date {
          locale => "en"
          timezone => "America/Argentina/Buenos_Aires"
          match => [ "timestamp", "dd/MM/yyyy:HH:mm:ss" ]
      }
  bla bla bla..
  }

This still gets me the same timestamp and doesn't edit the formatting.

2

What outcome are you trying to achieve here?

3

I'm trying to change my timestamp from:

2016-07-08T00:12:19.963Z

To:

08/07/2016:21:12:19

4

Ok, the date filter just takes a given format and then tries to turn it into ISO8601 as UTC.
It's not for changing it into a different format.

5

I just tested it and even if the time is incorrect on logstash, kibana displays the time correctly. How is this achieved? Will this time difference be a problem (3 hours) if I want to use curator to delete old elastic entries?

6

LS+ES store times in UTC.
KB converts that to the browser timezome.

Curator also assumes UTC.