Date field saved as default timezone

Elastic Stack Elasticsearch
1

I am back at this.
I am seating in CST time zone. most all my source are in CST time zone

but all my date field is saved in Elasticsearch as GMT time zone.
and my kibana (default setup as ) browser timezone is converting that GMT back to CST

why can't I save all my data at CST timezone and kibana takes it as is?

problem I am not having is when I run sql query it give me data on different time format. it is getting confusing.

2

This is output of my data from database

DAY_ACHIEVED records

02-DEC-19 00 655400

but same thing is shows up in elastic is
h | s
------------------------+---------------
2019-12-02T00:00:00.000Z|635872.0
2019-12-02T01:00:00.000Z|128556.0
2019-12-02T02:00:00.000Z|116842.0
2019-12-02T03:00:00.000Z|126606.0
2019-12-02T04:00:00.000Z|114090.0
2019-12-02T05:00:00.000Z|127968.0
2019-12-02T06:00:00.000Z|655400.0

at 6:00 but I want that to register at same time 02-Dec-19 00:00.00.000

3

All dates are stored in UTC (as milliseconds since the epoch, when using a date datatype). Kibana uses the browser timezone, you can change that, see https://www.elastic.co/guide/en/kibana/current/advanced-options.html

You can also change/configure timezones on queries/aggregations if needed.

1 Like
4

yes I understand I can change that.

but we want to save data in CST. that way when you use sql it comes out correctly

also if I can save data in CST then I can use brower as cst and it will display as it displays sames in database. if anyone runs cross check

5

looks like something along this line. elk looks like have release this in 7.5

https://www.elastic.co/blog/converting-local-time-to-iso-8601-time-in-elasticsearch?ultron=dec-2019&blade=newsletter&hulk=email&mkt_tok=eyJpIjoiT1RkbE16ZzJOMlU1T1RnMSIsInQiOiJ4NmZySmFLS05xK1ZLd1dxQzZqbHRnSVRhb0YzWHg0VUJBMzB1NUpCZTFPdzN0ZXFTODhiOFFUdnQ0WTVYRUs1a0l5a2ZFanEzdDBtaU11dTRXNnB6N2txTUNzYlJHTTJadWloQit5SXZlN01TSFdZYVZqZUc4K2h6YWYrWjQrYSJ9

6

I can only repeat what I said earlier: Dates are always stored in UTC. You can modify your queries or use an ingestion pipeline to get your data properly converted before indexing, like it is done in the link you mentioned.

7

Perefect thanks. I tested it.
basically for CTS I have to use timezone => Etc/UTC and it will save my data in elasticsearch with same time and not will change to +6.

then I will have to setup kibana (all user) timezone = Etc/UTC and they will see data on same time frame.

for London data I don't have to worry because it is already in GMT and elasticsearch saves in GMT.

1 Like
8

sounds good. quick reminder that there is daylight savings time in the UK, so make sure that is properly taken accounted for (or hopefully you can just ignore :slight_smile:

9

back to this topic again if someone can help me
I use timezone=> Etc/UTC and it saves all my date as is in elasticsearch.
I am sitting in CST timezone

Now I want to do same to singapore. what would be equivalent for that?

10

This date timezone is so confusing.
what simply I want to do is save date field as is, the way it comes from source and tell kibana not to convert anything.

is there a option for it?

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.