I am very new with all of elastic stack, so i hope that you guy can help in details.
I am trying to configure filebeat to send syslog directly to elasticsearch, however, the @timestamp of each entry seem to have wrong timezone (+7 hours compare with locace time of server)
I have done some research and test with below setting but that not have to resolve the problem:
- Stop filebeat
- add var.convert_timezone: true in system.yml
- delete the current pipeline: curl -XDELETE 'http://localhost:9200/_ingest/pipeline/filebeat-6.3.1-system-syslog-pipeline
- Start filebeat.
The strange things is I have metricbeat deployed in the same system but @timestamp is correct.
I am really in need of your suggestion.
Thank you all!