Hello,
using LogStash and ElasticSearch 5.6.10.
My documents have a few fields of type "date", besides @timestamp.
The template includes, for each one of them, a section like this
"my_datefield_1": {
"type": "date",
"format": "MM/dd/yy HH:mm:ss||MM/dd/yy HH:mm:ss.SSS"
},
I have just discovered that ElasticSearch expects them to be in UTC. As they are not, they are in local time, when I visualize the data with Kibana, all dates are shifted 4 hours -the different between my local time and UTC-.
So I was wondering what is the best way to convert the content of those fields to be in UTC when dumping the data into ElasticSearch:
- Should I use the LogStash Filter plugin "Alter" to change their values? Maybe the Ruby plugin?
- Is there a way to use the LogStash Filter plugin "Date" to change them from local to UTC?
- Or is it actually possible to do it thru the ElasticSearch Template, telling it that the dates are coming in Local Time format and letting ElasticSearch to do the conversion to UTC itself?
I don't feel 2. and 3. are actually possible, and I should go for 1.
But no harm in asking, in case I am missing something.
Thanks a lot in advance,
Jose