Timezone in UTC causes wrong filename

Elastic Stack Logstash
3

To do this using the @timestamp field is not possible, you will need to use a ruby filter to create auxiliary fields with the values that you want in the output, one field should have the pattern YYYY-MM-dd in your timezone, and the other field should have the @timestamp converted to your timezone.

Using one of the examples that @AClerk shared, you will need something like this.

filter {
    # this ruby filter sets the field [@metadata][index] as YYYY-MM-dd in your timezone
    ruby {
        code => "event.set('[@metadata][index]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d'))"
    }
    # this ruby filter sets the field [@metadata][timestamp] as YYYY-mm-dd HH:MM:ss.SSS
    ruby {
        code => "event.set('[@metadata][timestamp]', event.get('[@timestamp]').time.localtime.strftime('%Y-%m-%d %H:%M:%S.%L'))"
    }
    
}
output {
    file {
        codec => line { format => '%{[@metadata][timestamp]} %{message}'}
        path => "/var/log/logstash/debug.txt.%{[@metadata][index]}"
    }
}

This way you will create two auxiliary fields with the values you need in your timezone, the @timestamp field is always in UTC.

2 Likes