# Time zone adjustment

**URL:** <https://discuss.elastic.co/t/time-zone-adjustment/47459>\
**Category:** Logstash\
**Created:** [April 15, 2016, 5:42am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459 "2016-04-15T05:42:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [April 15, 2016, 5:42am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/1 "2016-04-15T05:42:13Z")

</div>

I have logs coming from various time zones into my ELK Stack in live. I have a table with time differences between those timezones and my local timezone from where i am running my ELK Stack. So using this table when ever logstash is parsing timestamp from a log, depending on that source i want to adjust that timestamp to local timezone and index into elasticsearch. So that when i view in kibana i can compare the docs from various timezones easily. Is there any way to do this in logstash.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 15, 2016, 5:55am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/2 "2016-04-15T05:55:06Z")

</div>

It sounds easier to stamp the events with the correct timezone at the source but sure, what you describe is possible. The translate filter should be useful for mapping "sources" (whatever that means) to timezone offsets. The resulting offset can be fed to the date filter that parses the timestamp in the log message itself.

---

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [April 15, 2016, 6:02am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/3 "2016-04-15T06:02:31Z")

</div>

I went trough translate filter and it seems to be string translation through regexes, where as i am having a date field, for example if i have a timestamp "Apr 12 19:24:26" parsed like  
date {  
"match" =\> ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
target =\> "@timestamp"  
}  
and due to timezone issue i want to parse it as Apr 12 17:24:26 , i need to do some numeric calculation right? How that can be done through this translate?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 15, 2016, 6:11am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/4 "2016-04-15T06:11:21Z")

</div>

The date filter will do that for you. Look at its `timezone` option. What you need to do is somehow figure out which timezone should be used.

If you can get the timezone information into the log messages that would be even easier.

---

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [April 15, 2016, 6:21am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/5 "2016-04-15T06:21:56Z")

</div>

Thanks a lot magnusbaeck , that solved my issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459/6 "2017-07-06T05:02:08Z")

</div>

Closed on July 6, 2017, 5:02am UTC