Filebeat system module auth log timezone conversion problem

Hmmm, I suspect that the pipeline was not deleted with that command since it lives under /_ingest not /filebeat-* in ES.

Check out the Ingest APIs, you'll probably find the old pipeline in there, and can delete it.