Filebeat 6.2.1 system module does not convert timestamp with timezone

The way the convert_timezone feature works is by installing an Elasticsearch ingest pipeline to do this conversion. Unfortunately, if a previous ingest pipeline already exists, filebeat will not update it with the required changes to make convert_timezone work.

You need to delete the existing pipeline manually and restart filebeat:

curl -XDELETE 'http://elasticsearch:9200/_ingest/pipeline/filebeat-*'
2 Likes