elasticsearch - Logstash omitting daylight saving time when parsing date -
my log file contains timestamp without timezone indicator. in format dd-mmm-yyyy::hh:mm:ss
my server located in central europe, in timezone utc+1 uses dst results in utc+2.
a date in log file: 2017-07-25::17:30:00
parsed 2017-07-25t16:30:00z
. should 2017-07-25t15:30:00z
. in dst now.
logstash seems consider timezone not dst.
how can fix this?
my logstash config:
date { match => ["logdate", "dd-mmm-yyyy::hh:mm:ss"] target => "@timestamp" remove_field => "logdate" }
you need specify timezone dates in:
date { match => ["logdate", "dd-mmm-yyyy::hh:mm:ss"] target => "@timestamp" remove_field => "logdate" timezone => "europe/zurich" <-- add line }
you may change "europe/zurich" whatever timezone makes sense you (other list of time zones might of use)
Comments
Post a Comment