github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 22:57:16 -04:00
Code Issues Projects Releases Packages Wiki Activity

docs: sprintf vs UTC nature of @timestamp field (#13576) (#13590)

Browse source 
Add notes to the Event sprintf docs about timestamp formatting to call out the
UTC nature of the Timestamp object.

Resolves: elastic/logstash#13112
Closes: elastic/logstash#13571
(cherry picked from commit ef40bb0643)
This commit is contained in:
Ry Biesemeyer 2022-01-06 15:52:07 -08:00 • committed by GitHub
parent 958d968e7a
commit e48a0810e6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/static/configuration.asciidoc vendored
View file

@ -377,10 +377,10 @@ output {
} }
---------------------------------- ----------------------------------
Similarly, you can convert the timestamp in the `@timestamp` field into a string. Instead of specifying a field name inside the curly braces, use the `+FORMAT` syntax where `FORMAT` is a http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html[time format]. Similarly, you can convert the UTC timestamp in the `@timestamp` field into a string. Instead of specifying a field name inside the curly braces, use the `+FORMAT` syntax where `FORMAT` is a http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html[time format].
For example, if you want to use the file output to write to logs based on the For example, if you want to use the file output to write to logs based on the
event's date and hour and the `type` field: event's UTC date and hour and the `type` field:
[source,js] [source,js]
---------------------------------- ----------------------------------
@ -391,6 +391,8 @@ output {
} }
---------------------------------- ----------------------------------
NOTE: A Logstash timestamp represents an instant on the UTC-timeline, so using sprintf formatters will produce results that may not align with your machine-local timezone.
[discrete] [discrete]
[[conditionals]] [[conditionals]]
==== Conditionals ==== Conditionals