Filebeat local date wrong

(Andy) #1

Total newbie here trying to get ELK Stack working in a test environment first ahead of deploying. I've managed to get everything working fine, including Winlogbeat and metricbeat, but filebeat for my linux hosts is giving me issues.

I have it shipping logs (messages and secure) fine, but when I search them in Kibana the date is wrong in the region of -14hrs.

When I run filebeat -e -v "publish" I can see the timestamp there is incorrect so thats where it is going wrong but I don't know how to change it. My server timestamp itself is correct and the time/date is correct in the message section of the log, but the @timestamp is not.

Any ideas?

(Andy) #2

Fixed it. Removed the filebeat client and re-installed from the same RPM and its working fine now with the correct date. No idea why it went wrong the first time as nothing has changed.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.