docs: sprintf vs UTC nature of @timestamp field (#13576) (#13590)

Add notes to the Event sprintf docs about timestamp formatting to call out the
UTC nature of the Timestamp object.

Resolves: elastic/logstash#13112
Closes: elastic/logstash#13571
(cherry picked from commit ef40bb0643)
This commit is contained in:
Ry Biesemeyer 2022-01-06 15:52:07 -08:00 committed by GitHub
parent 958d968e7a
commit e48a0810e6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -377,10 +377,10 @@ output {
}
----------------------------------
Similarly, you can convert the timestamp in the `@timestamp` field into a string. Instead of specifying a field name inside the curly braces, use the `+FORMAT` syntax where `FORMAT` is a http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html[time format].
Similarly, you can convert the UTC timestamp in the `@timestamp` field into a string. Instead of specifying a field name inside the curly braces, use the `+FORMAT` syntax where `FORMAT` is a http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html[time format].
For example, if you want to use the file output to write to logs based on the
event's date and hour and the `type` field:
event's UTC date and hour and the `type` field:
[source,js]
----------------------------------
@ -391,6 +391,8 @@ output {
}
----------------------------------
NOTE: A Logstash timestamp represents an instant on the UTC-timeline, so using sprintf formatters will produce results that may not align with your machine-local timezone.
[discrete]
[[conditionals]]
==== Conditionals