date format convertion in logstash elk stack

Question

I have a date column in my table that I fetch using jdbc input in logstash. The problem is logstash gives a wrong value to elasticsearch stack.

For example if I have a date start_date="2018-03-01" in elasticsearch I would get the value "2018-02-28 23:00:00.000" .

What I want is to keep the format of start_date or at least output the value " 2018-03-01 00:00:00.000 " to elasticsearch. I tried to use this filter :

date {
    timezone => "UTC"
    match => ["start_date" , "ISO8601", "yyyy-MM-dd HH:mm:ss"]
}

but it didn't work.

Answer 1

It is because, you are trying to convert it to UTC timezone. You need to change your configuration like this:

date {
  match => ["start_date" , "yyyy-MM-dd"]
}

This would be enough to parse your date.

Let me know if that works.