title: Convert log message timestamp to UTC before storing it in Elasticsearch
body: <p>I am collecting and parsing Tomcat access-log messages using Logstash, and am storing the parsed messages in Elasticsearch.
  I am using Kibana to display the log messges in Elasticsearch.
  Currently I am using Elasticsearch 2.0.0, Logstash 2.0.0, and Kibana 4.2.1.</p>
  
  <p>An access-log line looks something like the following:</p>
  
  <pre><code>02-08-2016 19:49:30.669 ip=11.22.333.444  status=200  tenant=908663983 user=0a4ac75477ed42cfb37dbc4e3f51b4d2 correlationId=RID-54082b02-4955-4ce9-866a-a92058297d81  request="GET /pwa/rest/908663983/rms/SampleDataDeployment HTTP/1.1" userType=Apache-HttpClient requestInfo=- duration=4 bytes=2548 thread=http-nio-8080-exec-5 service=rms itemType=SampleDataDeployment itemOperation=READ dataLayer=MongoDB incomingItemCnt=0 outgoingItemCnt=7 
  </code></pre>
  
  <p>The time displayed in the log file (ex. 02-08-2016 19:49:30.669) is in local time (not UTC!)</p>
  
  <p>Here is how I parse the message line:</p>
  
  <pre><code>filter {
  
          grok {
              match =&gt; { "message" =&gt; "%{DATESTAMP:logTimestamp}\s+" }
          }
  
          kv {}
  
          mutate {
              convert =&gt; { "duration" =&gt; "integer" }
              convert =&gt; { "bytes" =&gt; "integer" }
              convert =&gt; { "status" =&gt; "integer" }
              convert =&gt; { "incomingItemCnt" =&gt; "integer" }
              convert =&gt; { "outgoingItemCnt" =&gt; "integer" }
  
              gsub =&gt; [ "message", "\r", "" ]
          }
  
          grok {
              match =&gt; { "request" =&gt; [ "(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpVersion})?)" ] }
              overwrite =&gt; [ "request" ]  
          }
  
  }
  </code></pre>
  
  <p>I would like Logstash to convert the time read from the log message ('logTimestamp' field) into UTC before storing it in Elasticsearch.</p>
  
  <p>Can someone assist me with that please?</p>
  
  <p>--</p>
  
  <p>I have added the <em>date</em> filter to my processing, but I had to add a <em>timezone</em>.</p>
  
  <pre><code>    filter {
              grok {
                  match =&gt; { "message" =&gt; "%{DATESTAMP:logTimestamp}\s+" }
              }
  
              date {
                 match =&gt; [ "logTimestamp" , "mm-dd-yyyy HH:mm:ss.SSS" ]
                 timezone =&gt; "Asia/Jerusalem"
                 target =&gt; "logTimestamp"
              }
  
              ...
     }
  </code></pre>
  
  <p>Is there a way to convert the date to UTC without supplying the local timezone, such that Logstash takes the timezone of the machine it is running on?</p>
  
  <p>The motivation behind this question is I would like to use the same configuration file in all my deployments, in various timezones.</p>