# While overriding the @timestamp with log date , i am getting the time variation

**URL:** https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753
**Category:** Logstash
**Created:** [August 11, 2019, 5:49pm UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753 "2019-08-11T17:49:29Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![satyam2593](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@satyam2593](https://discuss.elastic.co/u/satyam2593)
#### Post date: [August 11, 2019, 5:49pm UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/1 "2019-08-11T17:49:30Z")

</div>

Why i am getting the time variation while overriding the @timestamp with logdate

My input: INFO | jvm 1 | 2019/05/06 23:39:05.254 | FileName:xxxx\_20190506 File Size:4096 File Collection time:2019-05-06 23:39:05.181  
INFO | jvm 1 | 2019/05/06 23:39:05.254 | FileName:xxxx\_1526726694\_15\_201904071415\_201904071430.csv File Size:6897823 File Collection time:2019-05-06 23:39:05.183

my stdout:  
filesize" =\> "13140176",  
"message" =\> "INFO | jvm 1 | **2019/05/07 06:13:08.498** | FileName:xxxx\_1526726660\_15\_201905061330\_201905061345.csv File Size:13140176 File Collection time:2019-05-07 06:13:08.458",  
"path" =\> "/usr/data/test.log",  
"file\_collection\_time" =\> "2019-05-07 06:13:08.458",  
**"@timestamp" =\> 2019-05-07T10:13:08.498Z,**  
"host" =\> "localhost.localdomain",  
"@version" =\> "1",  
**"logdate" =\> "2019/05/07 06:13:08.498",**  
"Filename" =\> "xxxxx\_1526726660\_15\_201905061330\_201905061345"

my config file:  
input {  
stdin{}  
}

filter {

```
    if "pmexport" in [message] {

    grok {
            match => { "message" => "%{WORD:LogLevel}%{SPACE}%{NOTSPACE}%{SPACE}%{WORD}%{SPACE}%{NUMBER}%{SPACE}%{NOTSPACE}%{SPACE}(?<logdate>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND})%{SPACE}%{NOTSPACE}%{SPACE}FileName:%{WORD:Filename}%{SPACE}File Size:%{INT:filesize}%{SPACE}File Collection time:%{TIMESTAMP_ISO8601:file_collection_time}"}

         }

    }

    else {

    grok {
             match => { "message" => "%{WORD}%{SPACE}%{NOTSPACE}%{SPACE}%{WORD}%{SPACE}%{NUMBER}%{SPACE}%{NOTSPACE}%{SPACE}(?<logdate>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND})%{SPACE}%{NOTSPACE}%{SPACE}FileName:%{WORD:Filename}.%{WORD}%{SPACE}File Size:%{INT:filesize}%{SPACE}File Collection time:%{TIMESTAMP_ISO8601:file_collection_time}"}

        }

    }

    date {
    match => ["logdate","yyyy/MM/dd HH:mm:ss.SSS"]
    target=> "@timestamp"
    locale => "en"
    timezone => "America/New_York"
         }

        }

```

output {  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 11, 2019, 7:19pm UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/2 "2019-08-11T19:19:51Z")

</div>

logstash timestamps are in UTC. You have told the date filter that the log entries are in the timezone America/New\_York, so it adds 4 hours to them (during DST) to get UTC.

---

<div class="post-metadata">

### Author: ![satyam2593](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@satyam2593](https://discuss.elastic.co/u/satyam2593)
#### Post date: [August 12, 2019, 3:22am UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/3 "2019-08-12T03:22:28Z")

</div>

so, now i have to replace the timezone as "UTC"

---

<div class="post-metadata">

### Author: ![satyam2593](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@satyam2593](https://discuss.elastic.co/u/satyam2593)
#### Post date: [August 12, 2019, 3:25am UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/4 "2019-08-12T03:25:21Z")

</div>

If i have single grok pattern and use timezone as "UTC" , then i am getting the correct value

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 12, 2019, 1:26pm UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/5 "2019-08-12T13:26:38Z")

</div>

Not sure what you mean by "the correct value". The entire elastic ecosystem assumes that timestamps are in UTC. So Kibana, for example, will translate those to the browser's timezone by default. If you are choosing to store timestamps in your local timezone you may find some things do not work as you expect.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 9, 2019, 1:26pm UTC](https://discuss.elastic.co/t/while-overriding-the-timestamp-with-log-date-i-am-getting-the-time-variation/194753/6 "2019-09-09T13:26:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.