Hello, Currently, I am using Elasticsearch v7.11 and filebeat v7.15 And I am retrieving owa logs from a directory on exchange. I noticed that the "@timestamp" and log message was way different. After further troubleshooting using the date processor I managed to get the logs with 2 hours difference. …

FALEN (Ali Can Saykal) November 29, 2021, 1:50pm 4

This topic can help you, i prefer the grok, its better for performance

Topic		Replies	Views
@timestamp kibana and log time are differents Elasticsearch	3	5685	May 21, 2019
1 Hour Difference on showing Logs in ELK/Kibana Elasticsearch	12	2360	May 4, 2021
How to make the changes in filebeat effective Beats filebeat	22	1166	February 2, 2021
Filebeat new timestamp field Beats filebeat	3	2603	May 29, 2018
Filebeat harvests log from elasticsearch and store field 'timestamp' without converting to utc time Beats elastic-stack-monitoring , filebeat	4	584	February 14, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat: Time different between ingest time and Message log time

Related topics