Logstash Date and Kibana Issues

[wwalker (Walker)]

Not really sure where this goes but it isn't getting any bites in the Logstash forums so...

I have a field that tracks when a ticket was created, sys_created_on. The time is in local timezone, -05:00 currently. I have the following logstash config:

  date {
    match => [ "sys_created_on", "yyyy-MM-dd HH:mm:ss" ]
    timezone => "America/Chicago"
  }

In Kibana, I am using the @timestamp field as the time field. When events come up in Kibana, they show a time that is five hours in the future. When I look at the JSON data, it is showing a timestamp 10 hours in the future. What the hell am I doing wrong??

[Aaron_Caldwell]

Hello,

I do think this belongs in the Logstash forum so I'll move it back over, but I did find this similar issue which may help!

Kibana Timezone settings

I am using logstash 5.1 streaming mysql data to elasticsearch 5.1, kibana 5 and this is my logstash code: input { jdbc { jdbc_driver_library => "./mysql-connector-java-5.1.36.jar" jdbc_driver_class => "com.mysql.jdbc.Driver" jdbc_connection_string => "jdbc:mysql://..." jdbc_user => "myuser" jdbc_password => "mypassword" jdbc_fetch_size => 200 statement => " select * from mytable where datetime >= '2016-12-01 11:00:00' and datetime < '2016-12-01 12:00:00' limit 1"…

Regards,
Aaron

[Badger]

Is sys_created_on a string? Also, what does your input look like? I am wondering if you are fetching from a DB and the input is doing the conversion to the local timezone or something like that.

[wwalker (Walker)]

http_poller pulls from an API endpoint that delivers the data in a json formatted document. The value is a string in the json and is local time.