Logstash causes 8 hour time difference solution due to time zone

Written at the top, the principle of this logstash to solve the time difference is to use the timestamp field to replace the @timesamp field of logstash.

If there is no timestamp field in the log, it is invalid.

Logstash version 2.3

---

Logstash's date plugin configuration:

date {
match =>["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
target =>"@timestamp"}

Check the parsing results and find that @timestamp is 8 hours ahead of China time

For page viewing, ELK's solution is to read the browser's current time zone on Kibana, and then convert the display of the time content on the page.
The solution found two
1,

vim vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.3-java/lib/logstash/timestamp.rb

Change @time = time.utc to time

2.
This method is related to the time zone setting of the Linux server. Some Linux may not be successfully modified. The first method is recommended.
http://www.aichengxu.com/view/6621766
1) Modify the logstash configuration

date {
match =>["timestamp","yyyy-MM-dd HH:mm:ss"]
target =>"@timestamp""locale"=>"en"
timezone =>"+00:00"}

Add timezone => "+00:00"
and then test @timestamp is the normal time, @timestamp and timestamp are the same.
2) Because kibana will read the browser's time zone, and then +8 hours, you need to modify the configuration of kibana.
Settings - Advanced - dateFormat:tz modified to UTC

After the Elasticsearch index creation error
was modified, it was found that when logstash was outputting to elasticsearch on a daily basis, the index of the day was created at 8:00 every day, and the data before 8:00 was still output to the index of yesterday, as shown in the figure:

The solution is as follows:

vim ./vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.3-java/lib/logstash/string_interpolation.rb
.withZone(org.joda.time.DateTimeZone::UTC)

change into

.withZone(org.joda.time.DateTimeZone.getDefault())

 

 

Logstash version 5.3

---

To solve the 8-hour time difference problem, the configuration is as follows:

    date {
        match =>["timestamp","dd/MMM/yyyy:HH:mm:ss +0800"]
        target =>"@timestamp""locale"=>"en"
        timezone =>"UTC"}