# Convert\_timezone alternative in Filebeat 7.3.0
**URL:** https://discuss.elastic.co/t/convert-timezone-alternative-in-filebeat-7-3-0/194160
**Category:** Beats
**Tags:** filebeat
**Created:** [August 7, 2019, 6:51am UTC](https://discuss.elastic.co/t/convert-timezone-alternative-in-filebeat-7-3-0/194160 "2019-08-07T06:51:44Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gmolina](https://discuss.elastic.co/u/gmolina)
#### Post date: [August 7, 2019, 6:51am UTC](https://discuss.elastic.co/t/convert-timezone-alternative-in-filebeat-7-3-0/194160/1 "2019-08-07T06:51:44Z")
In Filebeat 7.3.0 the way timezone conversion is applied is different. Now, you have to use processors to add, remove or change the "event.timezone" variable. Now, I can't get it to work, at least with the panw module. It seems that the ingest processor refuses to overwrite the date values.
If I don't do anything, event.timezone gets the value -02:00, and all the timestamps are added 2 hours
If I add in filebeat.yml:
processors:
- add\_fields:
target: "event"
fields:
timezone: "UTC"
event.timezone is changed to "UTC", but the timestamps are still 2 hours ahead.
I've been playing with the elasticsearch ingest pipeline, It seems that it is unable to overwrite the timestamp:
In "\_ingest/pipeline/filebeat-7.3.0-panw-panos-pipeline", If I add the target\_field:
{
"date" : {
"formats" : [
"ISO8601"
],
"timezone" : "{{ event.timezone }}",
"on\_failure" : [
{
"append" : {
"value" : "{{ \_ingest.on\_failure\_message }}",
"field" : "error.message"
}
}
],
"if" : "ctx.event.timezone != null",
"field" : "@timestamp"
"target\_field" : "AAAAAAAA"
}
},
The AAAAAAAA field is added, and the value is correct.
But if I remove the target\_field, meaning it should overwrite "@timestamp" in this case, It does not work.
The same happens with the other date fields, If target\_field is a new field, It gets added and the value is correct, but If not, It can not overwrite the same field.
Is there something missing?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 7, 2019, 11:27am UTC](https://discuss.elastic.co/t/convert-timezone-alternative-in-filebeat-7-3-0/194160/2 "2019-08-07T11:27:20Z")
Could you please format your configuration using ``?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2019, 11:29am UTC](https://discuss.elastic.co/t/convert-timezone-alternative-in-filebeat-7-3-0/194160/3 "2019-09-04T11:29:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.