logstash is shipping the data for the below query as expected
cast(systimestamp at time zone 'UTC' as timestamp )
however
cast( CREATION_TIMESTAMP at time zone 'UTC' as timestamp) is providing additional 2 hour (if your browser time zone is CEST )