Filebeat timestamp Ubuntu and CentOS

[MrSnaKe (Andrij Senyk)]

Hello, I have a problem with local time during send logs via filebeat and module system.

In ubuntu

uname -a
Linux ub 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

I add

• add_locale:
  format: offset

Time also set correct

root@ub:/etc/filebeat# timedatectl
Local time: Fri 2019-08-23 13:49:25 EEST
Universal time: Fri 2019-08-23 10:49:25 UTC
RTC time: Fri 2019-08-23 10:49:26
Time zone: Europe/Kiev (EEST, +0300)
System clock synchronized: yes
systemd-timesyncd.service active: yes
RTC in local TZ: no
root@ub:/etc/filebeat#

but on CentOS 7 with same add_locale

and same Time settings

[root@cos filebeat]# timedatectl
Local time: Fri 2019-08-23 13:53:21 EEST
Universal time: Fri 2019-08-23 10:53:21 UTC
RTC time: Fri 2019-08-23 10:53:21
Time zone: Europe/Kiev (EEST, +0300)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: no
DST active: yes
Last DST change: DST began at
Sun 2019-03-31 02:59:59 EET
Sun 2019-03-31 04:00:00 EEST
Next DST change: DST ends (the clock jumps one hour backwards) at
Sun 2019-10-27 03:59:59 EEST
Sun 2019-10-27 03:00:00 EET
[root@cos filebeat]#

I have a +3 hours in log

Any ideas where I did a mistake?

[jsoriano (Jaime Soriano)]

Hi @MrSnaKe,

This is probably related to https://github.com/elastic/beats/pull/13308, we are working on a solution.

Regards,
Jaime.

[MrSnaKe (Andrij Senyk)]

Hello,

Also same problem with Debian buster

in latest version

filebeat version 7.3.1 (amd64), libbeat 7.3.1 [a4be71b90ce3e3b8213b616adfcd9e455513da45 built 2019-08-19 19:30:50 +0000 UTC]

[MrSnaKe (Andrij Senyk)]

Last update on CentOS also did not fix the problem

--> Running transaction check
---> Package filebeat.x86_64 0:7.3.0-1 will be updated
---> Package filebeat.x86_64 0:7.3.1-1 will be an update
---> Package metricbeat.x86_64 0:7.3.0-1 will be updated
---> Package metricbeat.x86_64 0:7.3.1-1 will be an update
--> Finished Dependency Resolution