Custom UDP/TCP Log Timestamp

Elastic Search
1

Hello,

I'm a newbie with Elastic so patience please. I'm using the Custom UDP Log integration in a policy on my fleet server and sending logs from rsyslog on my linux box to the fleet server. I receive the logs just fine but they are showing up with a timestamp 5 hours earlier. I see that rsyslog is sending the logs in my current timezone (EST-5) but it would appear Elastic is not reading the timezone information. Kibana is displaying the logs using my browser timezone (EST) hence why the logs show up with a timestamp 5 hours behind. tailing /var/log/syslog shows that the logs have the timezone. See below.

image
image301×442 36.6 KB

Can you please suggest what I can do to have elastic show the right timestamps?

Thanks!

3

If you enabled syslog parsing on the UDP integration I believe that timestamp format should be supported.

Can you share your integration configuration, a sample syslog from the device and then can you grab the document for that sample syslog from kibana by finding a log entry, clicking expand, clicking the json tab and sharing the json? Can you also share your rsyslog configuration?