hi, I need help
the problem
I am using the logstash date filter, to assign the date from the log line, I need to use the timezone of my country Chile (America / Santiago) which is currently GMT-4, but when I review the data in kibana, @timestamp Figure as if it were timezone GTM-3
I know that @timestamp is stored in UTC and that the timezone in the date filter is only to calculate the date in UTC
example log line
20170726|180922|Current|0|0|0|0|0|0|
The date in log line is "20170726|180922" equivalent to 2017-07-26 18:09:22
Date filter used
Date{
Match => ["time", "yyyyMMdd '|' HHmmss"]
Timezone => "America / Santiago"
Remove_field => "time"
}
note: The time field is valid example "20170726|180922"
I have reviewed:
Tz-data, tzdata-java, tzinfo-data updated to the latest version
Date and server timezone ok
Date and timezone of java ok
kibana timezone ok
Versions
I test on Server Rhel7.1, Ubuntu 16.04 and Docker
Kibana 5.5
Logstasth 5.5
Elasticsearch 5.5
Filebeat 5.5
Try
I tried to use in logstash another timezone GTM-4 example (America / Aruba) which is GTM-4 and works fine, in kibana @timestamp is calculated with UTC-4
I do not know why the timezone America / Santiago logstash takes it as GTM-3, if it's America / Santiago is GTM-4 until the thirtieth of August
Date{
Match => ["time", "yyyyMMdd '|' 'HHmmss"]
Timezone => "America / Aruba"
Remove_field => "time"
}