You are using the system module in Filebeat. Under the hood this is using Elasticsearch's Ingest Node feature to parse the syslog logs. It then overwrites the @timestamp field added by Filebeat (which is actually in UTC) with the interpreted timestamp from the log line. Syslog doesn't include the timezone in the logs that it writes and the Ingest Node date processor assumes UTC.
I would recommend running all your systems with UTC time. But you can modify the pipeline to use a custom timezone (note that f you have multiple systems with different timezones sending syslogs this won't work). Wherever you installed Filebeat, there is a module/system/syslog/ingest/pipeline.json file. You can add a timezone to it. For example:
Thanks a lot Andrew, understand how that works now. Is it possible to configure the custom pipeline I would need for my use case? I'd like to avoid losing my modification when I upgrade filebeat. It does not appear to be a 'var' of the module.
(agree that running the OS in UTC would be better...)
Thanks for the feedback, I think a variable for the timezone makes sense in this module. Could you open a Github ticket for it, please? It's not trivial to implement because currently we insert the pipelines "as is" without expanding variables into them, but I think that's something we can add.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.