Incorrect @timestamp logstash date filter

Question

I'm using Logstash 1.4.2 on Windows.

I'm parsing a datetime from my logs (field 'timestamp_file') and i try to affect its value to the field @timestamp example of timestamp i'm parsing : 2015-03-09 00:35:11,073

    # format date
    date{
        match =>["timestamp_file","YYYY-MM-dd HH:mm:ss,SSS"]
        target => "@timestamp"
        }

But in Kibana i have a different value in field @timestamp (one hour gap) Example in kibana timestamp_file = 2015-03-12 15:34:30,580 @timestamp = 2015-03-12T15:34:30.580+01:00

In mappings, ES consider my field timestamp_file as a String not a date. It's may be because of that.

Any help is welcome to resolve this.

AlainCollins yes i'm in UTC+1. @BenLim i'm expecting to have the same timestamp as my field timestamp_file, or if it's in UTC can i have a meaningful display ? for instance 2015-03-12T22:17:24.803+01:00 And not 2015-03-12T21:17:24.803Z The Z means ZULU, but for users it's just a one hour gap ! — Fares

Ben Lim Ben Lim · Accepted Answer · 2015-03-17T01:13:09

Kibana will show the value in UTC time. So, if you want to show the @timestamp field in your timezone, like "@timestamp" => "2015-03-09T04:24:29.718+01:00", you have to do some conversion in filter.

input {
    stdin {}
}

filter {
    ruby {
        code => "event['@timestamp'] = event['@timestamp'].localtime('+01:00')"
    }
}

output {
    stdout {
         codec => rubydebug
    }
}

Incorrect @timestamp logstash date filter

1 Answers