We're updating the issue view to help you get more done. 

add option to define the @timestamp format to use the timezone


Logstash use a GMT timestamp internaly to store the event timestamp (@timestamp field).

When using the File output module (for example), I use :

1 2 3 4 5 6 file { flush_interval => 10 tags => ["got_syslog_standard"] path => "/opt/data/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{@source_host}/%{syslog_file_name}.log" message_format => "%{@timestamp} %{@source_host} %{@message}" }

Giving :

1 2012-07-10T20:05:05.000Z Built dynamic UDP translation from interne: to internet:

I would like to have the timestamp writen using my real timezone (GMT-4) like :

1 2012-07-10T16:05:05.000Z-0400 Built dynamic UDP translation from interne: to internet:

I see 3 ways to do this :

  • add an otpion to the File output to "auto" add the timestamp to every line, and an option to manage the timezone. This will only affect File output though

  • add something (a decorator) to the special @timestamp field to force a timezone representation, like : %{@timestamp:-0400}

  • create a logstash internal "alias" to @timestamp with a localized value using the Os timezone setting. Instead of using @timestamp in grok or outputs, use @localtimestamp that will transparently recalculate the timestamp value





Philippe Weber


sebastien THOMAS

Fix versions

Affects versions