I have something strange with timezones.
From my raspberry Pi I am sending some specific information (temperature) to Sylog (separate Syslog Server). Same format as normal syslog:
In my Syslog server I am splitting the logs sending two logs to Elastic:
All logging from the Raspberry Pi;
' Oct 19 11:54:24 PiMirror piinfo: gpu_temp=54.0;cpu_temp=53.0;model=4
' Oct 19 11:54:24 PiMirror sudo[4753]: pam_unix(sudo:session): session closed for user root
Specific logging.
' Oct 19 11:05:01 PiMirror piinfo: gpu_temp=52.1;cpu_temp=53.0;model=4
' Oct 19 11:54:24 PiMirror piinfo: gpu_temp=54.0;cpu_temp=53.0;model=4
In Elastic I copied the Syslog ingest pipeline exactly to a specific pipeline and added a KV processor to this specific pipeline, to split the values; I made a copy of the syslog index and a 3 fields to it.
All is working fine, a have a specific index for my Raspberry Pi info. But there is one problem, the specific index has a timestamp 2 hours ahead. That’s strange?
Thanks,
Herman