We're updating the issue view to help you get more done. 

Incorrect timestamp assigned when event arrives between 11am and 12am utc

Description

Event arriving between 1100 am and 1200 am UTC get a timestamp of 12 hours earlier.
See the following stdout output of logstash:
2013-11-26T10:55:54.000+0000 exa1db01 Tue Nov 26 11:55:54 2013
Starting background process XDWK
2013-11-26T10:55:54.000+0000 exa1db01 Tue Nov 26 11:55:54 2013
XDWK started with pid=39, OS id=8790
2013-11-25T23:10:56.000+0000 exa1db01 Tue Nov 26 12:10:56 2013
Starting background process XDWK
2013-11-25T23:10:56.000+0000 exa1db01 Tue Nov 26 12:10:56 2013
XDWK started with pid=43, OS id=31694

When querying logstash you see for example the following:
{
"_index" : "logstash-2013.11.25",
"_type" : "logs",
"_id" : "HEsqzofoQSegrw2zz9Babw",
"score" : 1.0, "_source" : {"message":"Tue Nov 26 12:10:56 2013\nXDWK started with pid=43, OS id=31694 ","@timestamp":"2013-11-25T23:10:56.000Z","@version":"1","type":"alert+asm.log","host":"exa1db01","path":"/u01/app/oracle/diag/asm/+asm/+ASM1/trace/alert+ASM1.log","tags":["multiline","grokked","datetime"],"datestamp":"Tue Nov 26 12:10:56 2013","wdn":"Tue","mtn":"Nov","md":"26","t":"12:10:56","y":"2013"}
}

The message is generated at Nov 26 12:10:56 CET which is Nov 26 11:10:56 UTC.
The timestamp it gets is of 12 hours earlier : Nov 25 23:10:56

Regards Hans-Peter

Environment

None

Status

Assignee

Logstash Developers

Reporter

Hans-Peter Sloot

Affects versions

1.2.2

Priority