Filebeat version : 5.0.0. Alpha 5.
Logstash version : 2.3.2
OS : Red Hat 7.x
I'm currently using filebeat to parse log files for an application that writes log entries using this format :
[2016-09-08 08:26:06.242] ALL MyManager my message
Notice how the timestamp doesn't store timezone information. While it's a bad practice on the application part, it's not always something I can control.
I have this application running on servers in multiple timezones, all sending their logs to the same Logstash server.
When I parse the logs with Logstash, it will assume that the logs are either in UTC or the Logstash server timezone, neither of which is accurate for all the logs.
I found a workaround for this by stamping the server timezone in my Filebeat config :
I then need to adjust this file on every new server (or automate it by writing a configuration generation script).
Would it help to offer an option to automatically stamp the local server timezone in every filebeat ?