Setting the correct timezone in date filter plugin

Hello,

I'm using a date filter plugin to match a date field, which is in the format yyyy-MM-dd (so the field does not provide the time, for example 2018-07-03). My desire would be to obtain Logstash parsing the date @00:00:00 my local time. Here's the filter I'm using

date {
	match => [ "timestamp_field", "yyyy-MM-dd" ]
	timezone => "UTC"
	target => "timestamp_field"
}

No matter if I use timezone => "UTC" or timezone => "Europe/Rome" (which is my local timezone), I always get the time in this format:

July 3rd 2018, 02:00:00.000

While I would like to get

July 3rd 2018, 00:00:00.000

By comparison, the field @timestamp, which contains the log parsing time, is perfectly correct.
What could be the issue here?

Are you seeing that format in Kibana? If so, that is working correctly. Elasticsearch stores the date in UTC, and Kibana will adjust that to Europe/Rome if that is the timezone your browser uses. If you want Kibana to display UTC you can change that in Management / Advanced Settings - dateFormat:tz

date {
match => [ "timestamp_field", "yyyy-MM-dd +0200" ]
timezone => "UTC"
target => "timestamp_field"
}

TRY

I tried to change that, but without luck

[Edit] I have re-indexed data and now is displayed correctly :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.