Setting the correct timezone in date filter plugin

Elastic Stack Logstash
1

Hello,

I'm using a date filter plugin to match a date field, which is in the format yyyy-MM-dd (so the field does not provide the time, for example 2018-07-03). My desire would be to obtain Logstash parsing the date @00:00:00 my local time. Here's the filter I'm using

date {
	match => [ "timestamp_field", "yyyy-MM-dd" ]
	timezone => "UTC"
	target => "timestamp_field"
}

No matter if I use timezone => "UTC" or timezone => "Europe/Rome" (which is my local timezone), I always get the time in this format:

July 3rd 2018, 02:00:00.000

While I would like to get

July 3rd 2018, 00:00:00.000

By comparison, the field @timestamp, which contains the log parsing time, is perfectly correct.
What could be the issue here?

2

Are you seeing that format in Kibana? If so, that is working correctly. Elasticsearch stores the date in UTC, and Kibana will adjust that to Europe/Rome if that is the timezone your browser uses. If you want Kibana to display UTC you can change that in Management / Advanced Settings - dateFormat:tz

3 
date {
match => [ "timestamp_field", "yyyy-MM-dd +0200" ]
timezone => "UTC"
target => "timestamp_field"
}

TRY

4

I tried to change that, but without luck

[Edit] I have re-indexed data and now is displayed correctly :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.