How do I change the time format and data format in logstash?

Question

I want to load mysql data using logstash and put it into elasticsearch.

I added the "jdbc:mysql://local:portnumber/test?zeroDateTimeBehavior=convertToNull" option to load the data from mysql.

The time format is changed when getting the value of the date field in mysql.

for example....
date field value : 2017-04-07 08:01:00
logstash value: 2017-04-06T23:01:00.000Z

I want to change the time format to Asia / Seoul (GMT + 9) format.

So I tried the below, but the format does not changes.

date{
match => ["reg_date","yyyy-MM-dd HH:mm:ss.S"]
#timezone => "UTC"
timezone => "Asia/Seoul"
}

I will change the format to 'yyyy-MM-dd HH: mm: ss.S' using 'ruby code' after changing the time format with 'date filter'.

How do I change the time format?

Answer 1

Logstash sets the timestamp always to UTC. You should change the timestamp on the presentation layer instead to another timezone.