Filebeat: Time different between ingest time and Message log time


Currently, I am using Elasticsearch v7.11 and filebeat v7.15 And I am retrieving owa logs from a directory on exchange. I noticed that the "@timestamp" and log message was way different. After further troubleshooting using the date processor I managed to get the logs with 2 hours difference.
I tried to assign the timezone on the date processor with no success. Check below snapshot of the log output and date processor.
OWA log output:

Date Processor config:

Any advise how to make the both time fields with the same timing.

Thank you,

Kibana simulates your browsers timezone when showing "datetime" formatted fields like @timestamp.

If you can check your kibana index settings, you can see the field type of date: field. Which is probably string for your case.(Im showing timestamp field, bcs i dont have date field on my side)

You can try below options,
-Try scripted fields in kibana index options
-Try changing name of that field in grok, so kibana will have a new field that is "date" formatted
-You can use reindex

Hello Ali,

Do you have the painless script for date ? Also, Shall I keep the date processor ?

This topic can help you, i prefer the grok, its better for performance

Hello Ali,

The above threat has no solution and it is misleading.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.