TL;DR
Which takes precedence in a date filter - the timezone in the timestamp or the timezone specified in the filter?
Longer Version
A question regarding the date filter. I have the following date filter:
date {
match => ["[@metadata][_timestamp]", "ISO8601"]
timezone => "US/Central"
target => "@timestamp"
tag_on_failure => []
}
If I have the following date, it will process it as the US Central timezone:
2019-08-22T12:00:00,000
However, if I have the following date:
2019-08-22T17:00:00,000Z
which translates to the same time in US Central Daylight time, will it process it as UTC (as specified in the timestamp), or will it disregard the timezone specified in the timestamp and use the timezone => "US/Central"
, causing it to store as an incorrect time? the following line in the date filter documentation seems to imply that the timezone option in the date filter is only used if it's not specified in the timestamp, but I want to confirm:
[The timezone option] is useful in case the time zone cannot be extracted from the value, and is not the platform default.