Filebeat system and iptables module timezone offset issue

Elastic Stack Beats
2

Hi @mback2k,

After changing the value of var.convert_timezone you need to setup the pipelines again. You can do it by restarting filebeat with filebeat.overwrite_pipelines: true in the configuration. Take into account that this option can override other pipelines that you have manually setup. You may want to remove this option once the pipelines are setup as you expect.

You can check if the pipelines are being correctly configured by executing GET _ingest/pipeline/filebeat-6.7.1-system-* and checking that the date processors include the timezone option, like in:

        "date" : {
          "field" : "system.syslog.timestamp",
          "target_field" : "@timestamp",
          "formats" : [
            "MMM  d HH:mm:ss",
            "MMM dd HH:mm:ss"
          ],
          "timezone" : "{{ beat.timezone }}",
          "ignore_failure" : true
        }

Regards,
Jaime.