All times are processed in UTC/GMT time. They are stored in Elasticsearch in UTC/GMT time. Kibana translates this back into whatever local time zone you are in. I understand that this might be inconvenient, especially where you want to be able to point to an index and say, "I know exactly what's in that," but even this behavior is beginning to deviate away from best practices for Elasticsearch. For example, the Rollover API approach to index management is to have your indices not rollover by date, necessarily (though you can do so if desired), but by size, so as to reduce the number of shards on each node in your server.
What is not clear is that even saving the timestamp in UTC format I can not understand why the same day of the year / day of the month has two different day of the week.
In a given timezone a day must be same week day from 00:00:00 up to 23:59:59 .
What I need is to "lock" the week day for any particular day of the year as I need to graph the access by week days.
If April 1st is Saturday at 6 AM it must be Saturday at 23:59:59 as the day of the year is the same no matter how you saved it.
Considering the actual behaviour ( in my particular case ) when the time of the day goes beyond 9 PM ( UTC -0300 ) week day changes but the timestamp indicates the same day of the year / day of the month as I showed in my example.
I ended up with two different week days for the same day of the year !
I can't tell from this where you're seeing @timestamp. If that is in Kibana, then it's UTC time that has been adapted back to your local timezone. If it is in Kibana, then it is exactly what I said it is, and it is indeed April 2nd at 00:00:44.648. If you are seeing that @timestamp value in Logstash, in stdout output with the rubydebug codec, then I would expect to see the timestamp in ISO8601 time. I used most of your configuration to demonstrate this:
According to the date filter you have configured, your timestamp fields look exactly like 2017-04-01 20:11:27.732 -0300 and 2017-04-01 21:00:44.648 -0300, but look what comes out of Logstash when I feed that in:
This is cut/pasted output behavior illustrating what I was trying to explain earlier. The -0300 time zone means that 21:00 in your time zone is actually 00:00 in UTC, which is what Logstash is reckoning in (as is Elasticsearch). Kibana just translates it back to a local timestamp for your viewing.
So now, April 1st 2017 will always be Saturday from 00:00:00 to 23:59:59 in my example.
I'm not saying that Kibana timestamp / timezone has any problem as it works as expected ( convert to the browser timezone ) but the conversion routine for Day Of the Week changes the week day for the same day of the year depending on the hour of the day.
As I need to graph by Day Of The Week and I know that every server LOG is related to just one specific day of the week this workaround did the trick.
I can't tell you if this is the best practice / code but its working so far.
I really appreciate all your comments and your help.