# PANW Integration - Timezone Offset Problem
**URL:** https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978
**Category:** Beats
**Tags:** beats-module, filebeat, elastic-agent
**Created:** [September 1, 2021, 3:33am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978 "2021-09-01T03:33:59Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@neil6323](https://discuss.elastic.co/u/neil6323)
#### Post date: [September 1, 2021, 3:33am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/1 "2021-09-01T03:33:59Z")
Elastic Cluster Version 7.14.0. I am using Elastic-Agent and the PANW integration to ingest Palo Alto Firewall logs. Once ingested the event times are incorrect by the equivalent of the timezone offset. I have found articles on how to resolve this with Filebeat and associated module but I'm struggling on how to achieve this in the Elastic-Agent and integration world. I'm referencing [https://discuss.elastic.co/t/panw-module-timezone-offset/191360](https://discuss.elastic.co/t/panw-module-timezone-offset/191360)
When I view the record there is no event.timezone field. I have tried to add to the integration processor as follows (I have left the drop\_fields line in ):
```auto
- drop_fields.fields: ['event.timezone']
- add_fields:
target: event
fields:
timezone: 'Australia/Brisbane'
```
But I presume I need to account for `filebeat.overwrite_pipelines: true` somehow - is that correct? Or is there something else I'm missing?
Thanks
Neil
---
### Author:  [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)
#### Post date: [September 1, 2021, 8:16am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/2 "2021-09-01T08:16:39Z")
Hi there @neil6323 . Thanks for reporting the issue 🙂
The issue with the integration is that from what I can see, timezone is never included in the logs itself, so there is no way for us to determine timezone.
Usually there is 2 options here when the source does not include a timezone:
1. You can add "add\_locale" processor to use the timezone of the beat/agent [Add the local time zone | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/add-locale.html)
2. You can define a custom timezone for the data itself.
What if we add a option in the integration page to fill in the timezone you want to use? So when you setup the Panw integration policy, in the settings page where you define all your settings, we can have a field to define timezone as well, which defaults to the local timezone of the beat?
---
### Author:  [@neil6323](https://discuss.elastic.co/u/neil6323)
#### Post date: [September 1, 2021, 8:56am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/3 "2021-09-01T08:56:34Z")
Hi Marius,
Thanks for your response. Yes, your understanding is spot on. Ultimately, this issue down to no timezone being sent in the log. And the onward effect is that the external threat reporting is all out of sync.
I think the option you've given to add a timezone in the settings page would solve the problem nicely.
Thanks
Neil
---
### Author:  [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)
#### Post date: [September 1, 2021, 9:32am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/4 "2021-09-01T09:32:38Z")
I have added the issue here, feel free to track it to get updates on when it is merged @neil6323 🙂
>
>
> The data from the PANW integration does not include timezone, and there is no ea…sy way to add a custom timezone to the ingest pipeline.
>
> We should add in 2 options to the package:
> 1. A integration setting in the UI to define timezones in the format expected by the date ingest pipeline processor.
> 2. Default to \`add\_locale ~\` if no timezone has been set
---
### Author:  [@neil6323](https://discuss.elastic.co/u/neil6323)
#### Post date: [September 1, 2021, 10:09pm UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/5 "2021-09-01T22:09:26Z")
Thanks @Marius_Iversen.
I added the `add_locale ~` to the processor.
This has had the desired result and the events are now reflecting the correct time.
And I'm tracking the issue in Github.
Thanks again.
Neil
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 30, 2021, 12:09am UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978/6 "2021-09-30T00:09:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.