ELK has changed my EventTime

Elastic Stack Elasticsearch
1

Hello Guys,
I was finding about in what Timezone ELK saved the data. I had read ELK saved the data for default in UTC.
I didn't find how to change the timezone in ELK config.

The output from client:

"date":"2016-05-24","time":"10:24:21","EventTime":"2016-05-24T10:24:21Z"

The output from Logstash:

"date":"2016-05-24","time":"10:24:21","EventTime":"2016-05-24T10:24:21Z"

But I saw the same data in ELK:

EventTime = May 24th 2016, 06:24:21.000
Time= 10:24:21

The field eventTime is created from field $date and $time got from data.

Anyway to set the timezone in ELK in EDT?.

Thank you.

2

I saw, this problem will fixed if I use time-zone in the java block.

I don't know if its is the right way.

Anyone know?.

Thank you.

3

ES only deals in UTC and that is what LS assumes it receives.
If your timestamps are localised, set things with the date filter.

4

Hello Warkolm
Understood, I resolved my problem added to logs the time in UTC. Isn't the best way but is work.

Thank you.

5

Yes, it is. It's an actual standard and the rest of the stack knows how to deal with it.