Below is the source field value in kibana.
_source: “Tue Jun 16 2015 07:00:57 [0x80e00173][network][error] : tid(2559): TCP connection attempt refused from 10.255.215.xxx to 10.255.215.xxx port xxxx” should have @timestamp “2015-06-16T07:00:57.000Z”, rather than “2015-06-16T11:00:57.000Z” (Z stands for Zulu time, aka UTC/GTM). When Kabana display @timestamp, it then converted it to local timezone (local host timezone)…
I still think @timestamp field was not populated correctly w.r.t time zone. I think data time in log is UTC based. So the raw value of @timestamp field should be the same as in log.
How to change time zone from Zulu. Appreciate the quick response.