# Filebeat timestamp is shown with a 4hr offset

**URL:** https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575
**Category:** Elasticsearch
**Created:** [September 21, 2023, 8:16pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575 "2023-09-21T20:16:20Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 21, 2023, 8:16pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575/1 "2023-09-21T20:16:20Z")

</div>

We have a Filebeat server (8.9) that ingests Syslog logs. The timestamp shown in GUI is 4 hours earlier than it should be. The timezone is set correctly in Kibana. The timestamp is correct when viewing JSON; it looks like: "@timestamp": "2023-09-21T16:12:00.000Z". In the GUI, it looks like   
"Sep 21, 2023 @ 12:12:00.000". We're in EST timezone, if that matters. We did a packet capture on incoming logs - the timezone is correct.

---

<div class="post-metadata">

### Author: ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 21, 2023, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575/2 "2023-09-21T20:19:57Z")

</div>

I should add that we also have a Zeek module running on the same Filebeat server, and the timestamps there are correct too!

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [September 22, 2023, 7:42am UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575/3 "2023-09-22T07:42:26Z")

</div>

> [@artschooldropout](#):
>
> it looks like: "@timestamp": "2023-09-21T16:12:00.000Z". In the GUI, it looks like  
> "Sep 21, 2023 @ 12:12:00.000". We're in EST timezone,

This seems like the expected behaviour: the Z at the end of `2023-09-21T16:12:00.000Z` indicates that this time is in UTC, but you have configured Kibana to show times in EST which is (currently) UTC+4.

---

<div class="post-metadata">

### Author: ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 22, 2023, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575/4 "2023-09-22T13:37:51Z")

</div>

Aha - ok thank you. I didn't know Kibana expected times to be in UTC but now that I think about it, it makes sense.

Thanks again for your help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2023, 1:38pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-is-shown-with-a-4hr-offset/343575/5 "2023-10-20T13:38:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
