Filebeat: Time different between ingest time and Message log time

Elastic Stack Beats
1

Hello,

Currently, I am using Elasticsearch v7.11 and filebeat v7.15 And I am retrieving owa logs from a directory on exchange. I noticed that the "@timestamp" and log message was way different. After further troubleshooting using the date processor I managed to get the logs with 2 hours difference.
I tried to assign the timezone on the date processor with no success. Check below snapshot of the log output and date processor.
OWA log output:

owa log output
owa log output1920×1080 52.7 KB

Date Processor config:

Date processor
Date processor705×750 42.4 KB

Any advise how to make the both time fields with the same timing.

Thank you,
E

2

Kibana simulates your browsers timezone when showing "datetime" formatted fields like @timestamp.

If you can check your kibana index settings, you can see the field type of date: field. Which is probably string for your case.(Im showing timestamp field, bcs i dont have date field on my side)

image
image1818×455 41.7 KB

You can try below options,
-Try scripted fields in kibana index options
-Try changing name of that field in grok, so kibana will have a new field that is "date" formatted
-You can use reindex

3

Hello Ali,

Do you have the painless script for date ? Also, Shall I keep the date processor ?

4

This topic can help you, i prefer the grok, its better for performance

5

Hello Ali,

The above threat has no solution and it is misleading.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.