Discover tab shows a different date than the indexed date

Elastic Stack Kibana
1

I am using ELK 6.4.1.
I am indexing a date field ExecutionDate. The filter block in logstash config file looks like below:
date {
match => ["ExecutionDate","ISO8601", "dd/MM/yyyy HH:mm:ss.SSS"]
target => "ExecutionDate"
locale => "en"
}

In Kibana, under Dev Tool, when I run GET /<index_name>/_search, I get below:
"_source": {
"host": "demo-mks",
"message": "23/08/2018 08:35:21.919,1,QA_MVA1_test_model.usp,PCA,data2\r",
"@timestamp": "2018-09-30T10:16:22.801Z",
"@version": "1",
"path": "/opt/elastic/elasticsearch/Data/stat_data_4950.csv",
"Pass": true,
"ActiveDCP": "data2",
"ExecutionDate": "2018-08-23T08:35:21.919Z",
"ModelName": "QA_MVA1_test_model.usp",
"ModelType": "PCA"
}

In Kibana, under discover tab, I see that the ExecutionDate is coming at a difference of +5.5hours (for 08:35am, it is showing as 14:05).
kibana

What am I missing here?

2

The document contains the raw data that has been indexed. These are all in UTC timezone. When Kibana shows results, it will however adjust this to the local timezone, which I assume is 5.5 hours off UTC in your case.

3

Thanks. Is there any way to turn off the timezone conversion feature in Kibana?

I believe, one turnaround is if I can index this data as string. But for doing date histogram or date range aggregations, I need this column as a date type. Is there any way I can show the raw data as it is as a date field in Kibana?

4

You can set the timezone used to UTC through dateFormat:tz under the advanced settings section. The raw data in Elasticsearch must however be in UTC timezone.

5

Thanks, it worked :slight_smile: