I am using version 7.2.0 and have system module enabled. What I am seeing is that when an event occures lets say at 6PM. When this event is sent to elasticsearch it assumes this is UTC and when opened in browser adjusts it to 2PM. However the event is really 6PM EST.
I see that there is a configuration value
- add_locale: ~
However that seems to be doing nothing. How do I configure filebeat to pickup the value from the system config? And then keep it the same?