Need to add timezone field to my output

Elastic Stack Logstash
1

Hi.

I need to add an extra field that will include the timezone of the local (LogStash agent) machine.
I have tried using add_field => {"TZ" => "%{+z}"} but it always give the UTC time.

Any way I can do that without specifying a fixed value (TZ => "Europe/Stockholm")?

2

I need to add an extra field that will include the timezone of the local (LogStash agent) machine.

I suspect you'll have to use a ruby filter. Assuming the timezone is in the TZ environment variable,

ruby {
  code => "event['TZ'] = ENV['TZ']"
}

should work. No, wait, there's also the environment filter.

I have tried using add_field => {"TZ" => "%{+z}"} but it always give the UTC time.

Yeah, because the @timestamp field is always UTC.