Daily index name and @timestamp value discrepancies


As many here, we use logstash to fill in data in ES and the output is a daily index with this format:

Yesterday (2016.03.01) , I saw a few a hours before midnight the next day index (today: 2016.03.02) appearing. But when viewing data in this new index, I saw data with the current day?

So, why the «March 1st 2016, 21:21» event is in the XXXXXX-2016.03.02 index?


Bruno Lavoie

The index names are based on UTC dates while the timestamp you see in Kibana by default it browser local time.

ha! so sorry I didn't thought of this detail.

So when we launch a query in Kibana, is he intelligent and use correctly date pattern accordingly?
I think it's yes...


Yes, Kibana will of course do the right thing here.