Kibana change the "now value" or current time

[JackieLaFrite]

Kibana "now" value is incorrect and i don't want it to modify the value of my time field.

If it's currently 12h05, logstash send the logs from 12h05 but Kibana with this settings :

Display the logs from 10h and add 2 hours to his time field.

I DO NOT WANT THAT, I don't want kibana to modify the time field, to avoid that I can set the timezone in the settings to UTC but if I do that the "now" value is equal to the UTC time (10h) and not the time from my timezone (Europe/Brussels) (12h) So i must modify the time range and add 2 hours it's horrible.

If i modify the time range by adding two hours and settings the tz in kibana to UTC (which is not but no other way to avoid the modification of the time field xd) it's good i have the current log with their valid time :

[jughosta (Julia Rechkunova)]

Hi @JackieLaFrite,

Maybe there is an issue with ingesting data if "now" is not what you expect.

Besides "Relative" time ranges, there is also an option to set an "Absolute" time range so neither "from" not "to" changes.

[stephenb (Stephen Brown)]

Hi @JackieLaFrite

I think I understand what you are looking for.

In short, the Time Zone setting for Kibana is Universal for All Date Fields in Kibana so in your Case the Time Zone picker can not be in local time and the times displayed in Discover can not then be in UTC.

BUT

There is a pretty quick way you can see both assuming you are on a fairly recent version of Elastic / Kibana. What Version are you on?

In short, Leave Kibana in Browser Zone and you can add a runtime field that will always show the UTC Time as a string and it will be available in Discover as a string, would that help?

I added a runtime field in the data view

Go to Kibana -> Stack Management - Data Views -> Add field

Here is the code

String utc_time = field('@timestamp').get(null).toString();
emit(utc_time);

And this is what it looks like

Perhaps this can help.