Filebeat syslog with wrong @timestamp

Elastic Stack Beats
1

Hi everyone,

I am very new with all of elastic stack, so i hope that you guy can help in details.
I am trying to configure filebeat to send syslog directly to elasticsearch, however, the @timestamp of each entry seem to have wrong timezone (+7 hours compare with locace time of server)
I have done some research and test with below setting but that not have to resolve the problem:

The strange things is I have metricbeat deployed in the same system but @timestamp is correct.

I am really in need of your suggestion.

Thank you all!

2

If you guy need any information or any configuration, please suggest and i will share the details.

3

Have you seen this: [Still Not Solved!] Filebeat cannot recognize timezone in syslog

4

Hi admlko,
Thank you for your response.
I tried with the same method but it did not help to resolve my issue.
I dont know what else could be missing from my setup.
Do you need any configuration from me end for further checking?

5

I am fairly certain that 7.3.1 broke var.convert_timezone for the system module as I have it working in 7.2 but can't get it to work in 7.3.1.

It is likely a bug.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.