# Time converted to EST, when Unixtime is already EST

**URL:** <https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734>\
**Category:** Logstash\
**Created:** [October 2, 2018, 4:30pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734 "2018-10-02T16:30:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nich240](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@Nich240](https://discuss.elastic.co/u/Nich240)\
**Post date:** [October 2, 2018, 4:30pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734/1 "2018-10-02T16:30:33Z")

</div>

The date passed from logstash is 4 hours before the time the event occurs.

I am receiving time as UNIX\_MS, but this is in EST. Therefore, the match will convert it to EST (taking off 4 hours) which it doesn't need to do, since it started in EST.

How can I let logstash know the time is already EST?

match =\> ["date", "UNIX\_MS"]  
timezone =\> "America/New\_York"  
target =\> "@timestamp".

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 3, 2018, 6:12pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734/2 "2018-10-03T18:12:36Z")

</div>

Epoch timestamps are by definition UTC so it's very odd if the data you're getting really is "seconds since 1970-01-01 00:00:00 EST". You can use a ruby filter to perform the conversion though.

---

<div class="post-metadata">

**Author:** ![Nich240](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@Nich240](https://discuss.elastic.co/u/Nich240)\
**Post date:** [October 3, 2018, 7:34pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734/3 "2018-10-03T19:34:51Z")

</div>

The data is not seconds after 1970. The data is 4 hours earlier than expected. ... The device where I gather the data is returning an epochtime that is based on the current timezone that I am in. It is not giving me the UTC that I expect. How can I change this after the timestamp is brought in? (I can't just add 4 hours, since when Daylight Savings ends, it would be 5 hours.)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 4, 2018, 7:21pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734/4 "2018-10-04T19:21:19Z")

</div>

If you perform the conversion and pretend that the epoch is UTC, can't you inspect the resulting date to figure out whether DST applies and based on that add 4 or 5 hours?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2018, 7:21pm UTC](https://discuss.elastic.co/t/time-converted-to-est-when-unixtime-is-already-est/150734/5 "2018-11-01T19:21:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.