We're updating the issue view to help you get more done. 

add option to define the @timestamp format to use the timezone

Description

Logstash use a GMT timestamp internaly to store the event timestamp (@timestamp field).

When using the File output module (for example), I use :

1 2 3 4 5 6 file { flush_interval => 10 tags => ["got_syslog_standard"] path => "/opt/data/syslog/%{+YYYY}/%{+MM}/%{+dd}/%{@source_host}/%{syslog_file_name}.log" message_format => "%{@timestamp} %{@source_host} %{@message}" }

Giving :

1 2012-07-10T20:05:05.000Z 10.100.252.52 Built dynamic UDP translation from interne:10.100.120.50/36389 to internet:20.17.17.2/17217

I would like to have the timestamp writen using my real timezone (GMT-4) like :

1 2012-07-10T16:05:05.000Z-0400 10.100.252.52 Built dynamic UDP translation from interne:10.100.120.50/36389 to internet:20.17.17.2/17217

I see 3 ways to do this :

  • add an otpion to the File output to "auto" add the timestamp to every line, and an option to manage the timezone. This will only affect File output though

  • add something (a decorator) to the special @timestamp field to force a timezone representation, like : %{@timestamp:-0400}

  • create a logstash internal "alias" to @timestamp with a localized value using the Os timezone setting. Instead of using @timestamp in grok or outputs, use @localtimestamp that will transparently recalculate the timestamp value

Environment

None

Status

Assignee

Philippe Weber

Reporter

sebastien THOMAS

Fix versions

Affects versions

1.1.0
1.1.1

Priority