Timezone in UTC causes wrong filename

[yodog]

i have a logserver with logstash only. no elasticsearch nor kibana.

all other servers are using filebeat to send log to the logserver.

logstash writes to /var/log/logstash/appname.txt.%{+YYYY-MM-dd} after some processing is done (filters).

the problem is that my timezone is -3 (brazil) but the filenames are in UTC.

how can i make sure the logs are writen in the correct file?

output {
    file {
        codec => line { format => '%{@timestamp} %{message}'}
        path  => '/var/log/logstash/debug.txt.%{+YYYY-MM-dd}'
    }
}

[AClerk]

Have you searched?

How to change logstash default timezone

Hello, In my system, I use filebeat and logstash. The data written to the log files are sent to logstash via filebeat. Some fields in the logs are filtered and saved in csv format using logstash. Problem: When saving data in CSV files I need to save data belongs to each day in sperate files. So my "output" is as follows. output { csv { path => "/var/csv_reports/%{+YYYY}-%{+MM}-%{+dd}/transaction-report.csv" fields => ["timestamp","tid","api","user","application","app_id", "body"…

Time in IST for log-rotation - Logstash

I have configured file-beat on all the App servers and Logstash in a centralized server for the log rotation. The config file in Log rotation is input { beats { port => 5044 } } filter{ mutate { remove_field => ["agent","input","host","architecture","containerized","mac","os","@version","log","ecs","offset"] } } output { file { path => "/log/sync/ims-v1/%{+dd-MM-yyyy}/%{+HH}-ims.log" } } -- In OUTPUT: Logstash to create a file/directory depending on an hourly basis for the logs: b…

And many more...

[leandrojmp (Leandro Pereira)]

To do this using the @timestamp field is not possible, you will need to use a ruby filter to create auxiliary fields with the values that you want in the output, one field should have the pattern YYYY-MM-dd in your timezone, and the other field should have the @timestamp converted to your timezone.

Using one of the examples that @AClerk shared, you will need something like this.

filter {
    # this ruby filter sets the field [@metadata][index] as YYYY-MM-dd in your timezone
    ruby {
        code => "event.set('[@metadata][index]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d'))"
    }
    # this ruby filter sets the field [@metadata][timestamp] as YYYY-mm-dd HH:MM:ss.SSS
    ruby {
        code => "event.set('[@metadata][timestamp]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d %H:%M:%S.%L'))"
    }
    
}
output {
    file {
        codec => line { format => '%{[@metadata][timestamp]} %{message}'}
        path => "/var/log/logstash/debug.txt.%{[@metadata][index]}"
    }
}

This way you will create two auxiliary fields with the values you need in your timezone, the @timestamp field is always in UTC.

[yodog]

perfect. thanks.