I've got a filebeat daemon outputting logs to my redis server. My logstash is getting the input from redis and the timestamps are looking like this: "2016-07-07T23:49:19.882Z". I'm trying to modify it with this logstash filter but can't seem to make it work.
locale => "en"
timezone => "America/Argentina/Buenos_Aires"
match => [ "timestamp", "dd/MM/yyyy:HH:mm:ss" ]
bla bla bla..
This still gets me the same timestamp and doesn't edit the formatting.
What outcome are you trying to achieve here?
I'm trying to change my timestamp from:
Ok, the date filter just takes a given format and then tries to turn it into ISO8601 as UTC.
It's not for changing it into a different format.
I just tested it and even if the time is incorrect on logstash, kibana displays the time correctly. How is this achieved? Will this time difference be a problem (3 hours) if I want to use curator to delete old elastic entries?
LS+ES store times in UTC.
KB converts that to the browser timezome.
Curator also assumes UTC.