# New timestamp using dynamic timezone not working

**URL:** https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166
**Category:** Logstash
**Created:** [August 16, 2017, 1:48am UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166 "2017-08-16T01:48:37Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![bitesize](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bitesize](https://discuss.elastic.co/u/bitesize)
#### Post date: [August 16, 2017, 1:48am UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166/1 "2017-08-16T01:48:37Z")

</div>

I am trying to add a field called localtimestamp to match the UNIX timestamp received in the json message:

`{"event": 1,"content": ["test","value1","value2","value3","value4"],"timestamp": 1502844683}`

This is my filter in logstash:

```
date {
        match => ["timestamp","UNIX"]
        timezone => "%{timezone}"
        target => "localtimestamp"
    }

```

Timezone is "timezone" =\> "America/Vancouver"

I was expecting timestamp 1502844683 (GMT Wednesday, August 16, 2017 12:51:23 AM) to be converted to localtimestamp Wednesday, August 15, 2017 09:51:23 PM but I get this:

"localtimestamp" =\> 2017-08-16T00:51:23.000Z. --\> appears to be GMT time  
"@timestamp" =\> 2017-08-16T01:46:00.230Z. --\> appears to be local UTC time

Any help would be appreciated.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 16, 2017, 10:12am UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166/2 "2017-08-16T10:12:47Z")

</div>

Unix timestamps (i.e. seconds since the epoch) are by definition always UTC and `@timestamp` is also always UTC. The `timezone` option indicates the timezone of the _source_ timestamp, but doesn't really apply when the UNIX or UNIX\_MS patterns are used.

---

<div class="post-metadata">

### Author: ![bitesize](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@bitesize](https://discuss.elastic.co/u/bitesize)
#### Post date: [August 16, 2017, 1:20pm UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166/3 "2017-08-16T13:20:40Z")

</div>

I tried this unsuccessfully. Any chance you could guide me to a solution so that I can have a new field with a converted timestamp?

```
 # "@timestamp": "2017-08-16T01:17:09.689Z"
  mutate {
        add_field => {
            # Create a new field with string value of the UTC event date
            "localtimestamp" => "%{@timestamp}"
        }
    }

      date {
        match => ["localtimestamp","yyyy-MM-dd'T'HH:mm:ss", "ISO8601"]
        timezone => "%{timezone}"
        target => "localtimestamp"
    }
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 16, 2017, 2:43pm UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166/4 "2017-08-16T14:43:36Z")

</div>

The date filter always produces a UTC timestamp. If you want a timestamp in the local timezone you'll have to use a ruby filter with some custom code.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2017, 2:43pm UTC](https://discuss.elastic.co/t/new-timestamp-using-dynamic-timezone-not-working/97166/5 "2017-09-13T14:43:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
