logstash/log4j-jsonevent-layout — pull request #19 by bfritz (2013-08-29 22:14:04+00:00)
Title: force @timestamp to UTC

Make sure `@timestamp` is in UTC rather than whatever random timezone the app server is set to. Eliminates the need for logstash hacks[1] to rewrite `@timestamp` when the server is using a local timezone.

Avoids the common Logstash+ElasticSearch+Kibana problem where data is stored in an index other than the one Kibana expects and searches are missing N hours of data, where N is the local offset from UTC.

[1] For example:

filter {

mutate {
tags => ["local_ts"]
rename => ["@timestamp", "_ts_local"]
}

date {
tags => ["local_ts"]
match => ["_ts_local", "ISO8601"]
add_tag => ["fixed_local_ts"]
remove_tag => ["local_ts"]
}

mutate {
tags => ["fixed_local_ts"]
remove => ["_ts_local"]
remove_tag => ["fixed_local_ts"]
}
}