# Not able to convert IIS Log Time to Australian Time Zone

**URL:** <https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875>\
**Category:** Logstash\
**Created:** [April 20, 2018, 12:27pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875 "2018-04-20T12:27:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nitin\_G](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@Nitin\_G](https://discuss.elastic.co/u/Nitin_G)\
**Post date:** [April 20, 2018, 12:27pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875/1 "2018-04-20T12:27:11Z")

</div>

Hi

I want to convert the IIS Logs time to Australia/Sydney time. Here is my Config code-

grok {

match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPV4:s-ip} %{WORD:cs-method} %{URIPATH:cs-uri-stem} %{NOTSPACE:cs-uri-query} %{BASE10NUM:s-port} %{NOTSPACE:cs-username} %{IPV4:c-ip} %{NOTSPACE:cs(User-Agent)} %{NOTSPACE:cs(Referer)} %{BASE10NUM:sc-status} %{BASE10NUM:sc-substatus} %{BASE10NUM:sc-win32-status} %{BASE10NUM:time\_taken}"}  
}

date {  
match =\> ["log\_timestamp", "yyyy-MM-dd HH:mm:ss"]  
timezone =\> "Australia/Sydney"  
target =\> "log\_timestamp"  
}

This **log\_timestamp** should be converted to AEST.  
Please help me to get it resolved.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 22, 2018, 8:25pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875/2 "2018-04-22T20:25:07Z")

</div>

The date filter always converts to UTC. This is not configurable. This has been discussed many times in the past so I will not elaborate further.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 24, 2018, 10:44pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875/3 "2018-04-24T22:44:20Z")

</div>

> [@Nitin\_G](#):
>
> date {
> 
> match =\> ["log\_timestamp", "yyyy-MM-dd HH:mm:ss"]
> 
> timezone =\> "Australia/Sydney"
> 
> target =\> "log\_timestamp"
> 
> }

IIS already stores logs in UTC time, so you just need to tell Logstash that the timestamp is already in UTC

```auto
date {
            match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss"]
            timezone => "Etc/GMT"
        }

```

Kibana will then display the log based on your browser's timezone.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2018, 10:44pm UTC](https://discuss.elastic.co/t/not-able-to-convert-iis-log-time-to-australian-time-zone/128875/4 "2018-05-22T22:44:25Z")

</div>

Closed on May 22, 2018, 10:44pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.