# Filebeat 7.3 Timezone Issues with System Module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 20, 2019, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971 "2019-08-20T16:09:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![DavidJohnson](https://avatars.discourse-cdn.com/v4/letter/d/b3f665/32.png) [@DavidJohnson](https://discuss.elastic.co/u/DavidJohnson)\ **Post date:** [August 20, 2019, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/1 "2019-08-20T16:09:09Z")
I have installed a new instance of Elasticsearch 7.3 and configured one host to send Filebeat data with Auditd and System modules. The auditd logs look correct. The System module collected data will not stop converting the timezone to UTC. When I view the logs in Kibana, everything picked up by the system module shows the data time as UTC. This was previously fixed by uncommenting and setting the var convert timezone setting to true in the system.yml file. I then set the filebeat.yml to add\_locale with the abbreviation. That resulted in the an error in processing that indicates PDT - the timezone the server is running in - as an unknown Timezone ID. It seems somethings have changed in version 7.3. Thoughts? ---
**Author:** ![DavidJohnson](https://avatars.discourse-cdn.com/v4/letter/d/b3f665/32.png) [@DavidJohnson](https://discuss.elastic.co/u/DavidJohnson)\ **Post date:** [August 20, 2019, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/2 "2019-08-20T16:10:38Z")
Oh and when I say "will not stop converting the timezone to UTC" I mean it is showing in kibana as UTC so everything appears to have happened hours earlier than it actually happened. And this is only true for the system module so far. ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [August 20, 2019, 9:44pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/3 "2019-08-20T21:44:10Z")
Did you run filebeat setup again after changing the convert timezone option? I think it changes code in the ingest pipeline. ---
**Author:** ![DavidJohnson](https://avatars.discourse-cdn.com/v4/letter/d/b3f665/32.png) [@DavidJohnson](https://discuss.elastic.co/u/DavidJohnson)\ **Post date:** [August 20, 2019, 10:03pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/4 "2019-08-20T22:03:41Z")
Yes. At each attempt I have deleted the created index, index pattern, deleted the ingest pipeline and deleted the template. Then run the filebeat setup command and started the service. Each time the timezone is wrong. ---
**Author:** ![Kent\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kent_wang/32/52610_2.png) [@Kent\_Wang](https://discuss.elastic.co/u/Kent_Wang)\ **Post date:** [August 21, 2019, 3:51am UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/5 "2019-08-21T03:51:45Z")
I have the same problem, and I submited a fix here. Hope that helps. > [@Filebeat 7.3 syslog / auth log timezone parsing error](https://discuss.elastic.co/t/filebeat-syslog-auth-log-timezone-parsing-error/196031): > > Hi Guys, I think there is something wrong in the system module ingest pipeline related to timezone processing. Here is an excerpt of date processors from pipipeline.json: { "date": { "field": "system.auth.timestamp", "target\_field": "@timestamp", "formats": ["MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"], "ignore\_failure": true } }, { "date": { "if": "ctx.event.timezone != null", "field… ---
**Author:** ![DavidJohnson](https://avatars.discourse-cdn.com/v4/letter/d/b3f665/32.png) [@DavidJohnson](https://discuss.elastic.co/u/DavidJohnson)\ **Post date:** [August 21, 2019, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/6 "2019-08-21T13:40:25Z")
Ok so that's two folks saying there is an issue. This seems to be a pretty big error. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2019, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-7-3-timezone-issues-with-system-module/195971/7 "2019-09-18T13:40:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.