I can't add a timezone setting to the timestamp.
The part of the parser that extracts the timestamp is below.
----------
date {
match => ["eventtime1", "UNIX", "UNIX_MS"]
on_error => "not_eventtime1_valid"
}
----------
I tried the following settings:
①
----------
date {
match => ["eventtime1", "UNIX", "UNIX_MS"]
timezone => "Asia/Tokyo"
on_error => "not_eventtime1_valid"
}
----------
Result:
No change.
②
----------
date {
match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]
timezone => "Asia/Tokyo"
on_error => "not_eventtime1_valid"
}
----------
Result:
Syntax error.
The current time is stored in UNIX time in timestamp.
Is it possible to reflect the time zone setting in the above settings?