Different time in copied index and pipeline

I have something strange with timezones.
From my raspberry Pi I am sending some specific information (temperature) to Sylog (separate Syslog Server). Same format as normal syslog:
In my Syslog server I am splitting the logs sending two logs to Elastic:
All logging from the Raspberry Pi;
' Oct 19 11:54:24 PiMirror piinfo: gpu_temp=54.0;cpu_temp=53.0;model=4
' Oct 19 11:54:24 PiMirror sudo[4753]: pam_unix(sudo:session): session closed for user root

Specific logging.
' Oct 19 11:05:01 PiMirror piinfo: gpu_temp=52.1;cpu_temp=53.0;model=4
' Oct 19 11:54:24 PiMirror piinfo: gpu_temp=54.0;cpu_temp=53.0;model=4

In Elastic I copied the Syslog ingest pipeline exactly to a specific pipeline and added a KV processor to this specific pipeline, to split the values; I made a copy of the syslog index and a 3 fields to it.

All is working fine, a have a specific index for my Raspberry Pi info. But there is one problem, the specific index has a timestamp 2 hours ahead. That’s strange?



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.