Timezone Precedence in Date Filter

TL;DR

Which takes precedence in a date filter - the timezone in the timestamp or the timezone specified in the filter?

Longer Version

A question regarding the date filter. I have the following date filter:

date {
    match => ["[@metadata][_timestamp]", "ISO8601"]
    timezone => "US/Central"
    target => "@timestamp"
    tag_on_failure => []
}

If I have the following date, it will process it as the US Central timezone:

2019-08-22T12:00:00,000

However, if I have the following date:

2019-08-22T17:00:00,000Z

which translates to the same time in US Central Daylight time, will it process it as UTC (as specified in the timestamp), or will it disregard the timezone specified in the timestamp and use the timezone => "US/Central", causing it to store as an incorrect time? the following line in the date filter documentation seems to imply that the timezone option in the date filter is only used if it's not specified in the timestamp, but I want to confirm:

[The timezone option] is useful in case the time zone cannot be extracted from the value, and is not the platform default.

You will get

"@timestamp" => 2019-08-22T17:00:00.000Z

It ignores the timezone option if the date includes the timezone, which it does.

Thanks. That's what I thought the docs implied and that would've been my assumption anyway, but it's good to have a confirmation.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.