Timestamp question

Elastic Stack Logstash
1

Hello,

I was just wondering what would be the correct setup for when the original logs that are being passed to logstash have a date time field that is all ready saved as UTC. Thats 2 hours behind local time.

I set the @timestamp from the log datetime and currenty this is what I'm using.

date {
                locale => "en"
                match => ["timestamp","YYYY-MM-dd HH:mm:ss"]
                remove_field => ["timestamp"]
                timezone => "Europe/Vienna"
        }
2

If the logs already are UTC then set timezone => "UTC" for the date filter.

3

Thanks. Works perfectly.

Kind regards,

Uros