# @timestamp value for syslog input not in UTC

**URL:** <https://discuss.elastic.co/t/timestamp-value-for-syslog-input-not-in-utc/354840>\
**Category:** Logstash\
**Created:** [March 6, 2024, 12:39pm UTC](https://discuss.elastic.co/t/timestamp-value-for-syslog-input-not-in-utc/354840 "2024-03-06T12:39:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![d14](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@d14](https://discuss.elastic.co/u/d14)\
**Post date:** [March 6, 2024, 12:39pm UTC](https://discuss.elastic.co/t/timestamp-value-for-syslog-input-not-in-utc/354840/1 "2024-03-06T12:39:45Z")

</div>

I'm using the syslog input to parse data from a syslog producer like this:

```auto
input {
    syslog {
        port => 5000
    }
}

```

The output of `stdout { codec => rubydebug }` shows that `@timestamp` is NOT in UTC but rather `EST`, the TimeZone value for the server on which Logstash is running.

` @timestamp" => 2024-03-06T07:23:01.000Z,` actual UTC is around `2024-03-06T12:23:01`

Please correct me if I'm wrong, but my understanding is that `@timestamp` automatically parses to UTC.

Is this normal? How can I force it to UTC?

---

<div class="post-metadata">

**Author:** ![d14](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@d14](https://discuss.elastic.co/u/d14)\
**Post date:** [March 6, 2024, 1:07pm UTC](https://discuss.elastic.co/t/timestamp-value-for-syslog-input-not-in-utc/354840/2 "2024-03-06T13:07:08Z")

</div>

Ha! I see where my issue is coming from. I forgot to set the `timezone` in the input.  
So adding `timezone => "America/New_York"` fixed the issue for me. `@timestamp` is now in UTC.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2024, 1:07pm UTC](https://discuss.elastic.co/t/timestamp-value-for-syslog-input-not-in-utc/354840/3 "2024-04-03T13:07:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.