Filebeat TimeZone Issue

#1

I am using version 7.2.0 and have system module enabled. What I am seeing is that when an event occures lets say at 6PM. When this event is sent to elasticsearch it assumes this is UTC and when opened in browser adjusts it to 2PM. However the event is really 6PM EST.

I see that there is a configuration value

processors:

  • add_locale: ~

However that seems to be doing nothing. How do I configure filebeat to pickup the value from the system config? And then keep it the same?

#2

Me too. I have the same problem as yours. This is a real bug and the Elastic team hasn't solve it yet.

See this thread: [Still Not Solved!] Filebeat cannot recognize timezone in syslog

#3

So there is no solution? I have set the convert time stamp to true in System module. I dont use logstash so filebeat sends directly to Kibana and its not converting the timestamp.

#4

I had this problem with a different module. My solution only worked for me because the logs came through in real time. If you need an older timestamp, this probably won't work.

My current "workaround" is removing any timestamp-related modification in the ingest pipeline:

  • /usr/share/filebeat/module/system/(auth or syslog)/ingest/pipeline.json on Linux
    ***Not sure where this lives on Windows

After editing this file, you have to delete the old ingest pipeline (the dev tools command will look something like this):

  • DELETE _ingest/pipeline/filebeat-7.2.0-system-*

Once the old pipeline is deleted, restart filebeat. The new pipeline will be registered and the @timestamp should be current.