hi there
i have a jdbc configuration to get data from oracle tables.
when running the configuration with the logstash service (meaning putting it in /etc/logstash/conf.d ) and restarting the service i get data with timestamp + 2 hours
example - the event timestamp is 9:00 AM but in kibana it shows 11:00 AM - which is wrong
BUT
when running the configuration manually (/usr/share/logstash/bin/logstash -f /path/to/conf_file ) the data arrives just fine and the timestamp is correct ( shows 9:00 in kibana)
note: i'm running the EXACT same configuration
tried to add timezone=> "UTC" and timezone=> "Asia/Jerusalem"
but the same thing keeps happening ( extra 2 hours)
it's like the service of logstash does not know the correct timezone
any idea why?