filebeat.modules: - module: postgresql log: enabled: true var.paths: ["/data/pgdata/pg_log/*.log"] input: tags: "server" processors: - drop_fields: fields: ["event.timezone"] ignore_missing: true - add_locale: format: offset
I was using the postgresql module to parse postgresql logs(filebeat version was 7.14). The problem was
@timestamp of log document in es after processed by the pipeline was parsed by incorrect event.timezone(which is CST which is ambiguous). actually the server timezone was +0800.
I have tried a log of ways include above(I noticed the postgresql pipeline parse timestamp with timezone specified in
event.timezone) and didn't change the result the event.timezone was CST, and @timestamp was ahead five hours. So I came here to get some help.
What I expected was let the pipeline parse timestamp with right timezone(+0800).