Timezone and logstash

(Olof Hellqvist) #1

I had a hack that worked fine until I upgraded to logstash 1.5.1 that converted UTC time to CEST.

The hack that no longer works (since localtime doesn't exist) was to convert the timestamp to my servers timezone (CEST):
ruby {
code => "event['@timestamp'] = event['@timestamp'].localtime((((Time.now).to_s).split(' ')[-1]).insert(3, ':'))"

The timestamp is in following format: 2015-07-07T15:11:08.393040+02:00

And I use the following joda pattern to parse it:
date {
match => ["timestampfield", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZZ"]
timezone => "Europe/Stockholm"

I want the timestamp in CEST since everything else in the elasticsearch cluster is in CEST, this type is now in UTC:
"@timestamp" => "2015-07-07T13:11:08.393Z"

What's the way to do this?

(peter) #2

I also encounter the same problem.

(system) #3