Pulling date from Elastic and convert it to local time zone

Elastic Stack Logstash
1

Hello,

I'm using Beats to to put data onto my Elasticsearch server. All machines incluing the monitored server are based in CET timezone. In Kibana i can see the @timestamp stored in CET, but when i pull it out using Logstash and put it into a flat file, it's stored in UTC. How can i make sure that the date i pull using Logstash is also stored as CET in flat file?
Thanks.

2

logstash and elasticsearch always store dates in UTC. Kibana converts them to the timezone of the browser.

If you are using a date filter to parse strings you can lie about what timezone the strings are in to get a LogStash::Timezone object in a timezone other than UTC.

3

Thanks @Badger,
So there's no easy way to convert it to a different timezone before outputting it into flat file?
If that's true, could you hint me how exactly i can 'lie' to Logstash to make sure that my output flat file will have the dates stored in CET rather than UTC?
Thanks!

4

If the timestamps in the log are UTC and you want to store them as (say) GMT+4, then tell the date filter they are GMT-4.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.