Hello,
I was just wondering what would be the correct setup for when the original logs that are being passed to logstash have a date time field that is all ready saved as UTC. Thats 2 hours behind local time.
I set the @timestamp from the log datetime and currenty this is what I'm using.
date {
locale => "en"
match => ["timestamp","YYYY-MM-dd HH:mm:ss"]
remove_field => ["timestamp"]
timezone => "Europe/Vienna"
}