Logstash/Kibana : time field incorrect

Elastic Stack Logstash
1

I've been stuck for 4 days on this problem.

The logs that appear in Kibana have their field time changed (+2 hours) + the logs that appear in kibana are logs from two hours ago.

It's currently 14h10, here is my last log that appear in logstash :

For example :

image
image1493×115 17.4 KB

The field time is the date extracted from the message, you can see that there is a shift of 2 hours.
That's the first problem.

The second problem is that the last log that should be retrieve should be another one from 14h25 not this one.

I don't know if this other problem is from logstash or kibana but only logs that are at least two hours old from the current time are recovered. So to get a log from 2pm I have to wait until it's 4pm at home. What the fuck.

Here is my logstash.conf file :

input {
  file {
    path => "/var/log/all_logs/common/logs/**/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => multiline {
        pattern => "^\d{4}-\d{2}-\d{2}"
        negate => true
        what => "previous"
    }
    type => "app"
  }
}
filter{
	if [type] == "app" {
		grok{
			match => {"message" => [
				"%{TIMESTAMP_ISO8601:time}  %{LOGLEVEL:log_level} %{GREEDYDATA:message_of_log}",
				"%{TIMESTAMP_ISO8601:time} \[ %{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}\(%{GREEDYDATA}\)",
				"%{TIMESTAMP_ISO8601:time} \[ %{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}",
				"%{TIMESTAMP_ISO8601:time} \[%{LOGLEVEL:log_level}\] %{GREEDYDATA:message_of_log}",
				"%{TIMESTAMP_ISO8601:time} \[%{DATA:miscellaneous}\] %{LOGLEVEL:log_level} %{GREEDYDATA:message_of_log}"
			]}
		}
		date{
			match => ["time", "yyyy-MM-dd HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss","dd-MMM-yyyy HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss,SSS"]
			timezone => "Europe/Brussels"
			target => "@time"
		}
	}
}

Before trying to fix this solution I didn't had this
date {

}

I was converting the time field to the date format in my index :

        "time": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dd-MMM-yyyy HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
2

The field [time] is extracted from the [message] field. There is no indication of what timezone it is in, so the default is UTC. That will be stored in elasticsearch as UTC, and when displayed in Kibana it will be converted to the local timezone (GMT+2), so 12:02:17.782 becomes 14:02:17.782.

In your date filter you are telling logstash that the 12:02:17.287 is in GMT+2, so the [@time] field will get set to 10:02:17.782, and that is what will be stored in elasticsearch. When Kibana displays that it will get adjusted forward to 12:02:17.287.

You said it is 14h10. How could it possibly display a log from 14h25?

3

Okay but I don't undestand why is Logstash retrieving the logs from 2 hours ago, like I said if it's 14h the logs from 12h are retrieve (I verified in the logs file), and I don't understand what timezone should I indicate in the date filter, is it really useful in my case ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.