# FileBeat Assumes UTC

**URL:** <https://discuss.elastic.co/t/filebeat-assumes-utc/156909>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 15, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/156909 "2018-11-15T16:57:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dison4linux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dison4linux/32/98141_2.png) [@dison4linux](https://discuss.elastic.co/u/dison4linux)\
**Post date:** [November 15, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/156909/1 "2018-11-15T16:57:03Z")

</div>

There is a closed thread here:

> [@Filebeat assumes UTC?](https://discuss.elastic.co/t/filebeat-assumes-utc/80896):
>
> I'm using filebeat to import syslog messages. When looking at the ES document it appears filebeat incorrectly assumes UTC: ES document: "@timestamp": "2017-04-01T15:26:51.000Z" Syslog message "timestamp": "Apr 1 15:26:51" OS: Sat Apr 1 15:26:51 CEST 2017 Should filebeat not store the @timestamp as 13:26:51?

Where @andrewkroh says, "I would recommend running all your systems with UTC time..."  
Does that mean all systems in the Elastic stack? Or all systems that we'd ever want to ingest logs from? If the Elastic stack needs to be in UTC time, we can head in that direction, but we are a MSP for clients in multiple timezones and as such cannot control which time zones the customer systems are in.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 15, 2018, 10:24pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/156909/2 "2018-11-15T22:24:50Z")

</div>

If you are referring to the Filebeat system module parsing syslog messages, then you can enable the `convert_timezone` option in the module to ensure the proper timezone is used with parsing the timestamps. See [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html#\_literal\_syslog\_literal\_fileset\_settings](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html#_literal_syslog_literal_fileset_settings).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2018, 10:35pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/156909/3 "2018-12-13T22:35:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.