Can you confirm your Kibana version, and from where you're generating the report? Searching through the forum and GitHub, I found a lot of (fixed) older reports of this issue:
My Machine Timestamp is correct, when I download the same reporting using my admin Space its looks like the correct timestamp, but with diferent user don't. But when I put kibana_adm Role to my user, the csv reporting look's correct. Why ?
I have two spaces (Admin and Super), with two logins (elastic and supervisor), with the supervisor only having read access and only to the Super space, he is a dashboard end-user.
The reports inside DISCOVERY are downloaded in csv and for the admin user (elastic) the timestamp used comes in the timestamp format of America / Belem.
When the Super user accesses the same report and does the download, the timestamp in the column does not come in the America / Belem format timestamp, but in the Browser. And it was not set in the Super space as a default.
However, for some reason when I give kibana_admin permission to the supervising user, I will download the report and it will come in the timestamp format America / Belem.
We've been discussing this, and we're going to treat it as a bug for now. I've created an issue here:
Please add your comments, perhaps help me "fill in the blanks", so to speak, about what I may be missing. We're having a hard time reproducing it, as well. It would be helpful to know specifically how the spaces are configured, the specifics of the user roles, the index privileges, etc.
Two suggestions for a short-term mitigation were:
Consider upgrading, if appropriate, or at least ensure you are running 7.9.3.
Set the timezone to America/Belem for all of Kibana in your kibana.yml:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.