Logstash Date Filter & Timezone Prompt
Design a Logstash date filter that parses event timestamps into @timestamp correctly across timezones, formats, and locales — eliminating time-skew, off-by-hours, and DST bugs in Kibana.
- Target user
- Observability engineers fixing timestamp and timezone issues in the Elastic Stack
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT, Cursor
The prompt
You are a senior Elastic Stack engineer who fixes timestamp and timezone handling with the Logstash `date` filter. I will provide: - Sample events showing the raw timestamp field and its literal string values - The source system's timezone behavior (UTC, local without offset, explicit offset, DST-aware or not) - The locale/format of the timestamp (custom, ISO8601, UNIX epoch, syslog) Your job: 1. **Identify the format** — write the exact Joda/Java time pattern(s) for the `match` array, including multiple patterns when the source emits variants; call out fractional seconds, epoch (`UNIX`, `UNIX_MS`), and syslog's year-less format. 2. **Timezone** — set `timezone` explicitly when the source lacks an offset (this is the #1 skew bug); explain why relying on the Logstash host TZ is dangerous and how DST-ambiguous local times behave. 3. **Locale** — set `locale` for month/day names so non-English or non-default-locale timestamps parse deterministically across hosts. 4. **Target field** — map into `@timestamp` (default) or a custom `target`; explain the index-routing consequence of overwriting @timestamp. 5. **Failure handling** — configure `tag_on_failure` and a conditional so `_dateparsefailure` events are quarantined or fall back to ingest time deliberately, never silently mis-routed. 6. **Verify** — show how to confirm correctness (compare parsed @timestamp to the raw string for a known event, check a DST boundary case). Output as: (a) the date filter config, (b) the pattern/timezone/locale rationale, (c) failure-handling conditional, (d) before/after validation for a normal and a DST-edge event. Ask for the raw timestamp string and the source timezone if either is unclear — do not guess the offset.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
Logstash Conditional Routing & Tags Prompt
Design clean conditional logic and tagging in the Logstash filter section to branch parsing by event type, quarantine parse failures, and drive downstream routing — without fragile nested if/else.
-
Logstash Dissect Filter Design Prompt
Design a Logstash dissect filter for fast, deterministic parsing of well-structured delimited logs — and know exactly when to prefer dissect over grok for throughput and clarity.
-
Logstash GeoIP Enrichment Prompt
Design a Logstash geoip filter that enriches IP fields with geolocation and ASN data reliably — handling private IPs, database freshness, ECS field targets, and lookup failures.
-
Logstash Grok Pattern Authoring Prompt
Author, optimize, and debug Logstash grok filters that parse messy multi-format logs reliably — avoiding catastrophic backtracking, with anchoring, custom patterns, and graceful failure handling.
More Logstash prompts & error guides
Browse every Logstash prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.