# Time zone in the field?

**URL:** <https://discuss.elastic.co/t/time-zone-in-the-field/247139>\
**Category:** Logstash\
**Created:** [September 1, 2020, 6:30pm UTC](https://discuss.elastic.co/t/time-zone-in-the-field/247139 "2020-09-01T18:30:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex9](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex9/32/72742_2.png) [@Alex9](https://discuss.elastic.co/u/Alex9)\
**Post date:** [September 1, 2020, 6:30pm UTC](https://discuss.elastic.co/t/time-zone-in-the-field/247139/1 "2020-09-01T18:30:15Z")

</div>

Good day 🙂  
(I probably have a simple question, but I haven't been able to figure it out on my own)

Please tell me how to properly configure the date display in the fields?

I have a service that, by a script, sends data to a node with Logstash.  
Here's a sample:

MOVIE125|24ad515d4|0009|01/09/2020 19:53:25|01/09/2020 19:53:35|STAR555|007

Here is the Logstash config file:

```auto
input {
  file {
    path => "/elk/data/service*"
# start_position => "beginning"
  }
}
 filter {
    csv {
        separator => "|"
            columns => ["SERVICE_NAME", "RECORD_TYPE", "SERVICE_ID", "SHIPMENT_TIME", "DELIVERY_TIME", "DEST_OPERATOR", "TOTAL_PARTS"]
    }
    grok {
        match => { "time" => "%{COMBINEDAPACHELOG}"}
    }
    date {
    match => ["timestamp", "dd/MM/YY HH:mm"]
    }
    }
output {
    elasticsearch {
        hosts => ["localhost:9200"]
        user => "elastic"
        password => " ******************"
        cacert => '/usr/share/logstash/elastic-certificates.pem'
        index => "service25"
        }
}

```

As you already understood 😀, with Logstash data is sent to Elasticsearch.  
Here is the index mapping diagram:

```auto
PUT service25
{
  "mappings": {
    "properties": {
      "SERVICE_NAME": {
        "type": "text",
        "fields": {
          "exact": {
            "type": "keyword"
          }
        }
      },
     "RECORD_TYPE": {
       "type": "text",
        "fields": {
          "exact": {
            "type": "keyword"
          }
        }
      },
      "SERVICE_ID": {
        "type": "text",
        "fields": {
          "exact": {
            "type": "keyword"
          }
        }
      },
      "SHIPMENT_TIME": {
        "type": "date",
        "format": "dd/MM/yyyy HH:mm:ss"
      },
      "DELIVERY_TIME": {
        "type": "date",
        "format": "dd/MM/yyyy HH:mm:ss"
      },
      "DEST_OPERATOR": {
        "type": "text",
        "fields": {
          "exact": {
            "type": "keyword"
          }
        }
      },
      "TOTAL_PARTS": {
        "type": "text",
        "fields": {
          "exact": {
            "type": "keyword"
          }
        }
      }
      }
  }
}

```

**At the exit in Kibana, I get the time in the "SHIPMENT\_TIME" and "DELIVERY\_TIME" fields for three hours more.**

![Annotation 2020-09-01 210643](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1ae7ceb9b8537920cbf4e83204142216959605b.png)

Time zone on my server and on pc is GMT + 3

I changed the "Timezone for date formatting" parameter in Advanced Settings Kibana from "Browser" to Етс / GMT + 0, but then I get the wrong time (minus three hours) in the @timestamp field

Please tell me where to make the change to get the correct time in the fields?  
**Thanks in advance to everyone!**

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 1, 2020, 7:52pm UTC](https://discuss.elastic.co/t/time-zone-in-the-field/247139/2 "2020-09-01T19:52:06Z")

</div>

You are using a mapping template to tell elasticsearch how to parse the SHIPMENT\_TIME and DELIVERY\_TIME fields, but I am not aware of a way to tell elasticsearch what timezone to use, so it assumes the times are UTC.

Instead of having elasticsearch parse them you can have logstash parse them

```
date { match => ["DELIVERY_TIME", "dd/MM/yyyy HH:mm:ss"] timezone => "Etc/GMT-3" }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2020, 7:52pm UTC](https://discuss.elastic.co/t/time-zone-in-the-field/247139/3 "2020-09-29T19:52:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.