I have a time field like this:
"time_local" => "23/Nov/2017:18:54:31 +0800"
And i want to use date filter to extract it to field @timestamp, so i have the filter pattern like this:
match => [ "time_local", "dd/MMM/yyyy:HH:mm:ss Z" ]
But what i got the result looks like this:
"time_local" => "23/Nov/2017:18:54:31 +0800",
"@timestamp" => 2017-11-23T10:54:31.000Z,
The letter Z does not recongized by date filter?
No, this is fine. The "Z" at the end of the
@timestamp value just indicates that the timezone of the timestamp is UTC.
@magnusbaeck Thanks for your response. What should i do if i want to reserve the original timezone?
@timestamp is always UTC. This is not configurable. This topic has been discussed many times before, please check the archives.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.