# Ingesting America/Chicago timezone logs with no tz indicator
**URL:** https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643
**Category:** Beats
**Tags:** filebeat
**Created:** [August 27, 2024, 8:37pm UTC](https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643 "2024-08-27T20:37:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@wmei](https://discuss.elastic.co/u/wmei)
#### Post date: [August 27, 2024, 8:37pm UTC](https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643/1 "2024-08-27T20:37:49Z")
Hi.
I have the following log entries. The timestamp is local system time but not UTC. I currently do not have a way to adjust the logs to include a tz.
```auto
D 2024-08-27T08:29:36,537 [Library] Logger - [MESSAGE] (1028445676) Received logging message
D 2024-08-27T08:29:37,307 [Library] Logger - [MESSAGE] Sent logging message
D 2024-08-27T08:29:39,537 [Library] Logger - [MESSAGE] (1028445676) Received logging message
D 2024-08-27T08:29:39,707 [Library] Logger - [MESSAGE] Sent logging message
D 2024-08-27T08:29:42,108 [Library] Logger - [MESSAGE] Sent logging message
D 2024-08-27T08:29:42,537 [Library] Logger - [MESSAGE] (1028445676) logging message
D 2024-08-27T08:29:44,508 [Library] Logger - [MESSAGE] Sent logging message
D 2024-08-27T08:29:45,537 [Library] Logger - [MESSAGE] (1028445676) logging message
D 2024-08-27T08:29:46,908 [Library] Logger - [MESSAGE] Sent logging message
D 2024-08-27T08:29:48,537 [Library] Logger - [MESSAGE] (1028445676) Received logging message
```
The issue I am having is that filebeat is ingesting these logs and they are stored in Elasticsearch as UTC. This causes confusion as Kibana is doing the tz conversion back to America/Chicago resulting in the time being off.
I added -timestamp but in Kibana I do not see the test field. This is assuming I am thinking about this the right way.
Any help will be appreciated.
```auto
filebeat.inputs:
- type: log
enabled: true
paths:
- /usr/share/filebeat/ingest_data/server*.log
multiline:
pattern: '^\t'
match: after
processors:
- add_tags:
tags: ['server']
- dissect:
field: message
tokenizer: "%{level} %{timestamp} [%{thread}] %{logger} - %{msg}"
- dissect:
field: log.file.path
tokenizer: "%{?path}/server.%{instance}.%{?ext}"
- timestamp:
field: "[dissect][timestamp]"
timezone: Local
layouts:
- '2024-08-27T08:29:39,707'
- '2024-08-27T08:29:48,537'
target_field: test-field
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 28, 2024, 3:08am UTC](https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643/2 "2024-08-28T03:08:48Z")
> [@wmei](#):
>
> ```auto
> - timestamp:
> field: "[dissect][timestamp]"
> timezone: Local
> layouts:
> - '2024-08-27T08:29:39,707'
> - '2024-08-27T08:29:48,537'
> target_field: test-field
>
> ```
What is the machine timezone?
I would explicitly set the timezone instead of using _Local_.
Have you tried using `timezone: America/Chicago` ?
---
### Author:  [@wmei](https://discuss.elastic.co/u/wmei)
#### Post date: [August 28, 2024, 5:27am UTC](https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643/3 "2024-08-28T05:27:01Z")
The machine timezone is America/Chicago. The test-field doesn't get created and I see \_dateparsefailure.
---
### Author:  [@wmei](https://discuss.elastic.co/u/wmei)
#### Post date: [August 28, 2024, 3:45pm UTC](https://discuss.elastic.co/t/ingesting-america-chicago-timezone-logs-with-no-tz-indicator/365643/4 "2024-08-28T15:45:34Z")
I have solved this by adding the add\_locale to the filebeat processor.
```auto
- add_locale:
format: offset
```
Then I added this to the logstash filter. The field log-local-timezone now shows the expected time as compared to [dissect][timestamp]
```auto
if [event][timezone] {
date {
match => ["[dissect][timestamp]", "yyyy-MM-dd'T'HH:mm:ss,SSS"]
timezone => "%{[event][timezone]}"
target => "log-local-timezone"
add_tag => ["log-local-timezone"]
}
}
}
```