Timezone offset now calculated for grep
logstash stores data in UTC time and the grep function uses the local timezone to convert time to logstash @timestamp format
i changed 20 start = case units.to_s.downcase 21 when 'm', 'min', 'mins', 'minute', 'minutes' 22 Time.now - value_60 23 when 'h', 'hr', 'hrs', 'hour', 'hours' 24 Time.now - value_3600 25 when 'd', 'day', 'days' 26 Time.now - value_86400 27 when 'w', 'wk', 'wks', 'week', 'weeks' 28 Time.now - 7.0_value_86400 29 when 'y', 'yr', 'yrs', 'year', 'years' 30 Time.now - 365.0_value*86400 31 else 32 raise ArgumentError 33 end 34 [start, Time.now]
to
20 start = case units.to_s.downcase 21 when 'm', 'min', 'mins', 'minute', 'minutes' 22 Time.now.utc - value_60 23 when 'h', 'hr', 'hrs', 'hour', 'hours' 24 Time.now.utc - value_3600 25 when 'd', 'day', 'days' 26 Time.now.utc - value_86400 27 when 'w', 'wk', 'wks', 'week', 'weeks' 28 Time.now.utc - 7.0_value_86400 29 when 'y', 'yr', 'yrs', 'year', 'years' 30 Time.now.utc - 365.0_value*86400 31 else 32 raise ArgumentError 33 end 34 [start, Time.now.utc]