Incorrect timestamp assigned when event arrives between 11am and 12am utc

Description

Event arriving between 1100 am and 1200 am UTC get a timestamp of 12 hours earlier.
See the following stdout output of logstash:
2013-11-26T10:55:54.000+0000 exa1db01 Tue Nov 26 11:55:54 2013
Starting background process XDWK
2013-11-26T10:55:54.000+0000 exa1db01 Tue Nov 26 11:55:54 2013
XDWK started with pid=39, OS id=8790
2013-11-25T23:10:56.000+0000 exa1db01 Tue Nov 26 12:10:56 2013
Starting background process XDWK
2013-11-25T23:10:56.000+0000 exa1db01 Tue Nov 26 12:10:56 2013
XDWK started with pid=43, OS id=31694

When querying logstash you see for example the following:
{
"_index" : "logstash-2013.11.25",
"_type" : "logs",
"_id" : "HEsqzofoQSegrw2zz9Babw",
"score" : 1.0, "_source" : {"message":"Tue Nov 26 12:10:56 2013\nXDWK started with pid=43, OS id=31694 ","@timestamp":"2013-11-25T23:10:56.000Z","@version":"1","type":"alert+asm.log","host":"exa1db01","path":"/u01/app/oracle/diag/asm/+asm/+ASM1/trace/alert+ASM1.log","tags":["multiline","grokked","datetime"],"datestamp":"Tue Nov 26 12:10:56 2013","wdn":"Tue","mtn":"Nov","md":"26","t":"12:10:56","y":"2013"}
}

The message is generated at Nov 26 12:10:56 CET which is Nov 26 11:10:56 UTC.
The timestamp it gets is of 12 hours earlier : Nov 25 23:10:56

Regards Hans-Peter

Assignee

Logstash Developers

Reporter

Hans-Peter Sloot

Affects versions

Configure