Importing data without a timezone is not UTC

Elastic Stack Kibana
1

Hey,

I am using the CSV upload to import a data file with roughly 300k entries. Import works fine, but I have some questions about time zones.

I have a field looking like this 2022-11-04 00:09:09 that does not contain a timezone. My expectation was, that this is imported as UTC, but apparently Kibana tries to be smart and somehow takes my local timezone into account, which then offsets my queries by that timezone.

Is this a feature I can disable - or mentioned in the docs? I couldn’t see this with a quick search. I also cannot seem to set a default timezone in the import or I was blind. :slight_smile:

Thanks for any help!

–Alex

2

Hey @spinscale

The default time zone for @timestamp field in kibana import is event.timezone.

By default, Ingest pipeline parse the CSV file and add your browser timezone thanks to event.timezone. You can update it from “Advanced“ settings just before push the data. Please note that It’ll affect the timestamp not @timestamp

image
image1920×1041 73.8 KB

The @timestamp field must be preserved as is. You should see two data fields @timestamp and timestamp. Kibana discover sort by original time value by default.

image
image1920×1024 137 KB

Curl request and Dev Tools:

The is like the following:

GET timestamp-test/_search     
     {
        "_index": "timestamp-test",
        "_id": "sL7fYZkBR8-_xqjxHdE5",
        "_score": 1,
        "_source": {
          "amount": 115.15,
          "@timestamp": "2022-11-04T00:09:09.000+03:00",
          "order_id": "ORD1000",
          "timestamp": "2022-11-04 00:09:09"
        }
      }

If you are using a curl request, use timestamp field instead of @timestamp

image
image1920×962 114 KB

1 Like