You are using the system module in Filebeat. Under the hood this is using Elasticsearch's Ingest Node feature to parse the syslog logs. It then overwrites the @timestamp field added by Filebeat (which is actually in UTC) with the interpreted timestamp from the log line. Syslog doesn't include the timezone in the logs that it writes and the Ingest Node date processor assumes UTC.
I would recommend running all your systems with UTC time. But you can modify the pipeline to use a custom timezone (note that f you have multiple systems with different timezones sending syslogs this won't work). Wherever you installed Filebeat, there is a module/system/syslog/ingest/pipeline.json file. You can add a timezone to it. For example:
{
"date": {
"field": "system.syslog.timestamp",
"target_field": "@timestamp",
"timezone": "EST",
"formats": [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss"
],
"ignore_failure": true
}
}
Save the change. Stop Filebeat. Delete the pipeline from Elasticsearch. And restart Filebeat.
You can delete the pipeline with
curl -XDELETE http://elasticsearch:9200/_ingest/pipeline/filebeat-5.3.0-system-syslog-pipeline
