# Filebeat timestamp Ubuntu and CentOS

**URL:** <https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 23, 2019, 10:54am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501 "2019-08-23T10:54:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrSnaKe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrsnake/32/52904_2.png) [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)\
**Post date:** [August 23, 2019, 10:54am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501/1 "2019-08-23T10:54:26Z")

</div>

Hello, I have a problem with local time during send logs via filebeat and module system.

In ubuntu

> uname -a  
> Linux ub 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86\_64 x86\_64 x86\_64 GNU/Linux

I add

> - add\_locale:  
> format: offset

Time also set correct

> root@ub:/etc/filebeat# timedatectl  
> Local time: Fri 2019-08-23 13:49:25 EEST  
> Universal time: Fri 2019-08-23 10:49:25 UTC  
> RTC time: Fri 2019-08-23 10:49:26  
> Time zone: Europe/Kiev (EEST, +0300)  
> System clock synchronized: yes  
> systemd-timesyncd.service active: yes  
> RTC in local TZ: no  
> root@ub:/etc/filebeat#

 ![52](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96d494df16cca3567ec8c5a4da3c44659ae715a8.jpeg)

but on CentOS 7 with same add\_locale

and same Time settings

> [root@cos filebeat]# timedatectl  
> Local time: Fri 2019-08-23 13:53:21 EEST  
> Universal time: Fri 2019-08-23 10:53:21 UTC  
> RTC time: Fri 2019-08-23 10:53:21  
> Time zone: Europe/Kiev (EEST, +0300)  
> NTP enabled: yes  
> NTP synchronized: yes  
> RTC in local TZ: no  
> DST active: yes  
> Last DST change: DST began at  
> Sun 2019-03-31 02:59:59 EET  
> Sun 2019-03-31 04:00:00 EEST  
> Next DST change: DST ends (the clock jumps one hour backwards) at  
> Sun 2019-10-27 03:59:59 EEST  
> Sun 2019-10-27 03:00:00 EET  
> [root@cos filebeat]#

I have a +3 hours in log

 ![15](https://us1.discourse-cdn.com/elastic/original/3X/5/5/55439f49bff68500030a71eb2d15f43fa65aba05.jpeg)

Any ideas where I did a mistake?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 23, 2019, 11:31am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501/2 "2019-08-23T11:31:00Z")

</div>

Hi @MrSnaKe,

This is probably related to [https://github.com/elastic/beats/pull/13308](https://github.com/elastic/beats/pull/13308), we are working on a solution.

Regards,  
Jaime.

---

<div class="post-metadata">

**Author:** ![MrSnaKe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrsnake/32/52904_2.png) [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)\
**Post date:** [August 23, 2019, 11:35am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501/3 "2019-08-23T11:35:40Z")

</div>

Hello,

Also same problem with Debian buster

 ![47](https://us1.discourse-cdn.com/elastic/original/3X/5/8/580694ef19227b6cf5febad712546a45797368d9.jpeg)  
 ![52](https://us1.discourse-cdn.com/elastic/original/3X/1/7/17b64283cc809b71b989b2c742f31fc26cb0f97c.jpeg)

in latest version

> filebeat version 7.3.1 (amd64), libbeat 7.3.1 [a4be71b90ce3e3b8213b616adfcd9e455513da45 built 2019-08-19 19:30:50 +0000 UTC]

---

<div class="post-metadata">

**Author:** ![MrSnaKe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrsnake/32/52904_2.png) [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)\
**Post date:** [August 27, 2019, 9:56am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501/4 "2019-08-27T09:56:31Z")

</div>

Last update on CentOS also did not fix the problem

> --\> Running transaction check  
> ---\> Package filebeat.x86\_64 0:7.3.0-1 will be updated  
> ---\> Package filebeat.x86\_64 0:7.3.1-1 will be an update  
> ---\> Package metricbeat.x86\_64 0:7.3.0-1 will be updated  
> ---\> Package metricbeat.x86\_64 0:7.3.1-1 will be an update  
> --\> Finished Dependency Resolution

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2019, 9:56am UTC](https://discuss.elastic.co/t/filebeat-timestamp-ubuntu-and-centos/196501/5 "2019-09-24T09:56:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.