Filebeat local date wrong

Total newbie here trying to get ELK Stack working in a test environment first ahead of deploying. I've managed to get everything working fine, including Winlogbeat and metricbeat, but filebeat for my linux hosts is giving me issues.

I have it shipping logs (messages and secure) fine, but when I search them in Kibana the date is wrong in the region of -14hrs.

When I run filebeat -e -v "publish" I can see the timestamp there is incorrect so thats where it is going wrong but I don't know how to change it. My server timestamp itself is correct and the time/date is correct in the message section of the log, but the @timestamp is not.

Any ideas?

Fixed it. Removed the filebeat client and re-installed from the same RPM and its working fine now with the correct date. No idea why it went wrong the first time as nothing has changed.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.