How to fix @timestamp at metricbeat alert

[Thanadol_Thadasade]

Hi, @spinscale
I having a new problems with @timestamp, because this output doesn't match my computer times (date is match, but times doesn't match) .

This output from ctx.trigger.scheduled_time

And this my computer times

2017-07-13, 09:43:12

thanks

[spinscale (Alexander Reelsen)]

welcome to the joyful world of time zones

everything in elasticsearch and x-pack is considered UTC. You might need to change your query... see https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-range-query.html#_time_zone_in_range_queries

[Thanadol_Thadasade]

Sorry, for late to reply. @spinscale
I used "time_zone" in my search query, but same result.

This my input search

"input": {
"search": {
"request": {
"indices": [
"metricbeat-2017.07.14"
],
"types" : [
"metricsets"
],
"body": {
"size": 10,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-5m",
"time_zone": "+07:00"
}
}
},
{
"term": {
"metricset.name" : "memory"
}
},
{
"range": {
"system.memory.used.pct" : {
"from" : 0.75
}
}
}
]
}
},
"aggs": {
"hosts": {
"terms": {
"field": "beat.hostname",
"size": 10
},
"aggs": {
"values": {
"max": {
"field": "system.memory.used.pct"
}
}
}
}
}
}
}
}
}

thanks

[Thanadol_Thadasade]

Metricbeat import data at field @timestamp isn't UTC time.

Example data.

And my computer times.

10:16:49

or fix at metricbeat config ?

thanks

[Thanadol_Thadasade]

I know Elastic Stack (beats, logstash, etc.) all used UTC.

And I tried do lecture from you tell, but same result.

Can you help me again ? @spinscale

thanks.