Add timezone local to all events with fleet-managed elastic agent

Is there a way to include an add_locale.format: 'offset' processor by default for all events sent in by a fleet-managed elastic agent? I have a number of custom logs that don't have proper timezone indicators, so my ingest pipelines frequently set the timezone from event.timezone when processing the date. This has been part of the my filebeat template, however it's easy to forget when configuring custom logs with fleet!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.