Filebeat 7.3 Timezone Issues with System Module

Elastic Stack Beats
1

I have installed a new instance of Elasticsearch 7.3 and configured one host to send Filebeat data with Auditd and System modules. The auditd logs look correct. The System module collected data will not stop converting the timezone to UTC. When I view the logs in Kibana, everything picked up by the system module shows the data time as UTC. This was previously fixed by uncommenting and setting the var convert timezone setting to true in the system.yml file. I then set the filebeat.yml to add_locale with the abbreviation. That resulted in the an error in processing that indicates PDT - the timezone the server is running in - as an unknown Timezone ID.

It seems somethings have changed in version 7.3.

Thoughts?

2

Oh and when I say "will not stop converting the timezone to UTC" I mean it is showing in kibana as UTC so everything appears to have happened hours earlier than it actually happened. And this is only true for the system module so far.

3

Did you run filebeat setup again after changing the convert timezone option? I think it changes code in the ingest pipeline.

4

Yes. At each attempt I have deleted the created index, index pattern, deleted the ingest pipeline and deleted the template. Then run the filebeat setup command and started the service. Each time the timezone is wrong.

5

I have the same problem, and I submited a fix here. Hope that helps.

6

Ok so that's two folks saying there is an issue. This seems to be a pretty big error.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.