# Why my @timestamp shows wrong hour when overwritten?

**URL:** <https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368>\
**Category:** Logstash\
**Created:** [November 28, 2021, 4:11pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368 "2021-11-28T16:11:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk\_chaser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk_chaser/32/76982_2.png) [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\
**Post date:** [November 28, 2021, 4:11pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368/1 "2021-11-28T16:11:18Z")

</div>

```auto
echo "Nov 25 11:12:15 test message goes here" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } 
filter { 
grok {
	   keep_empty_captures => true
	   match => { "message" =>  
	   "^(?<logTime>%{SYSLOGTIMESTAMP:ts}) .*$" }
	   add_tag => ["parsed_msg"]
	   remove_tag => ["_grokparsefailure"]
     }
  date {
    match => ["ts", "MMM d hh:mm:ss", "MMM dd hh:mm:ss", "ISO8601"]
    target => "@timestamp" 
	remove_field => ["ts"]
  }
 }' --path.data /tmp/test
 
 ---output -----
 {
       "logTime" => "Nov 25 11:12:15",
      "@version" => "1",
       "message" => "Nov 25 11:12:15 test message goes here",
    "@timestamp" => 2021-11-25T16:12:15.000Z,
          "host" => "myhost",
          "tags" => [
        [0] "parsed_msg"
    ]
}

```

------ problem/Expectation ------  
Actual hour stamp is 11 hour, the @timestamp shows 16 hour; why?  
How can we make @timestamp show hour as 11?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 28, 2021, 4:17pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368/2 "2021-11-28T16:17:21Z")

</div>

The `@timestamp` field uses UTC and this can't be changed.

The time `Nov 25 11:12:15` does not any timezone reference, so if I'm not wrong, the timezone used by the logstash date filter will be the logstash server timezone.

What is the server timezone? What is your timezone? What is the timezone of the date in the log file?

Since your date does not have timezone information, you should pass this information to the date filter using the `timezone` option.

---

<div class="post-metadata">

**Author:** ![elk\_chaser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk_chaser/32/76982_2.png) [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\
**Post date:** [November 28, 2021, 5:32pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368/3 "2021-11-28T17:32:01Z")

</div>

Hi Leonardo,  
Thanks for your quick reply.  
Adding timezone =\> "UTC" to my configuration worked like a charm.  
Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2021, 5:32pm UTC](https://discuss.elastic.co/t/why-my-timestamp-shows-wrong-hour-when-overwritten/290368/4 "2021-12-26T17:32:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.