# How to fix @timestamp at metricbeat alert

**URL:** https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 13, 2017, 10:01am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981 "2017-07-13T10:01:35Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)
#### Post date: [July 13, 2017, 10:01am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/1 "2017-07-13T10:01:36Z")

</div>

Hi, @spinscale  
I having a new problems with @timestamp, because this output doesn't match my computer times `(date is match, but times doesn't match)` .

This output from **ctx.trigger.scheduled\_time**  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9e90c8e4e427d15c171a600401c9573f098af3f.png)

And this my computer times

> 2017-07-13, 09:43:12

thanks

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 13, 2017, 11:51am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/2 "2017-07-13T11:51:03Z")

</div>

welcome to the joyful world of time zones 🙂

everything in elasticsearch and x-pack is considered UTC. You might need to change your query... see [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-range-query.html#\_time\_zone\_in\_range\_queries](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-range-query.html#_time_zone_in_range_queries)

---

<div class="post-metadata">

### Author: ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)
#### Post date: [July 14, 2017, 3:16am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/3 "2017-07-14T03:16:36Z")

</div>

Sorry, for late to reply. @spinscale  
I used `"time_zone"` in my search query, but same result.

This my **input search**

> "input": {  
> "search": {  
> "request": {  
> "indices": [  
> "metricbeat-2017.07.14"  
> ],  
> "types" : [  
> "metricsets"  
> ],  
> "body": {  
> "size": 10,  
> "query": {  
> "bool": {  
> "filter": [  
> {  
> `"range": {`  
> `"@timestamp": {`  
> `"from": "now-5m",`  
> `"time_zone": "+07:00"`  
> }  
> }  
> },  
> {  
> "term": {  
> "metricset.name" : "memory"  
> }  
> },  
> {  
> "range": {  
> "system.memory.used.pct" : {  
> "from" : 0.75  
> }  
> }  
> }  
> ]  
> }  
> },  
> "aggs": {  
> "hosts": {  
> "terms": {  
> "field": "beat.hostname",  
> "size": 10  
> },  
> "aggs": {  
> "values": {  
> "max": {  
> "field": "system.memory.used.pct"  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }

thanks

---

<div class="post-metadata">

### Author: ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)
#### Post date: [July 14, 2017, 3:20am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/4 "2017-07-14T03:20:02Z")

</div>

Metricbeat import data at field **@timestamp** isn't UTC time.

Example data.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c91e5a3b0c5f5b71625f3e3b186949d75db8e0af.png)

And my computer times.

> 10:16:49

`or fix at metricbeat config ?`

thanks

---

<div class="post-metadata">

### Author: ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)
#### Post date: [July 17, 2017, 10:11am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/5 "2017-07-17T10:11:15Z")

</div>

I know Elastic Stack (beats, logstash, etc.) all used UTC.

And I tried do lecture from you tell, but same result.

Can you help me again ? @spinscale

thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 14, 2017, 10:11am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981/6 "2017-08-14T10:11:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.