Discover tab shows a different date than the indexed date

I am using ELK 6.4.1.
I am indexing a date field ExecutionDate. The filter block in logstash config file looks like below:
date {
match => ["ExecutionDate","ISO8601", "dd/MM/yyyy HH:mm:ss.SSS"]
target => "ExecutionDate"
locale => "en"
}

In Kibana, under Dev Tool, when I run GET /<index_name>/_search, I get below:
"_source": {
"host": "demo-mks",
"message": "23/08/2018 08:35:21.919,1,QA_MVA1_test_model.usp,PCA,data2\r",
"@timestamp": "2018-09-30T10:16:22.801Z",
"@version": "1",
"path": "/opt/elastic/elasticsearch/Data/stat_data_4950.csv",
"Pass": true,
"ActiveDCP": "data2",
"ExecutionDate": "2018-08-23T08:35:21.919Z",
"ModelName": "QA_MVA1_test_model.usp",
"ModelType": "PCA"
}

In Kibana, under discover tab, I see that the ExecutionDate is coming at a difference of +5.5hours (for 08:35am, it is showing as 14:05).
kibana

What am I missing here?

The document contains the raw data that has been indexed. These are all in UTC timezone. When Kibana shows results, it will however adjust this to the local timezone, which I assume is 5.5 hours off UTC in your case.

Thanks. Is there any way to turn off the timezone conversion feature in Kibana?

I believe, one turnaround is if I can index this data as string. But for doing date histogram or date range aggregations, I need this column as a date type. Is there any way I can show the raw data as it is as a date field in Kibana?

You can set the timezone used to UTC through dateFormat:tz under the advanced settings section. The raw data in Elasticsearch must however be in UTC timezone.

1 Like

Thanks, it worked :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.