# PANW module timezone offset
**URL:** https://discuss.elastic.co/t/panw-module-timezone-offset/191360
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [July 19, 2019, 9:30am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360 "2019-07-19T09:30:21Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@seatsea](https://discuss.elastic.co/u/seatsea)
#### Post date: [July 19, 2019, 9:30am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/1 "2019-07-19T09:30:21Z")
I have a Paloalto firewall configured with the local timezone Europe/Paris sending syslog to a Filebeat Docker container using the default timezone of UTC using the PANW module.
Setting `var.convert_timezone: true` does not seem to have an impact so the the logs are being incorrectly stored in ES with UTC+2.
What part of the configuration do I need to change for the timestamps to be correct?
Is there a way for me to specify what timezone the incoming logs are using?
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [July 19, 2019, 2:52pm UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/2 "2019-07-19T14:52:47Z")
Hi @seatsea and welcome 🙂
`var.convert_timezone: true` does two things:
- It includes the timezone of the machine in the `event.timezone` field.
- It adds a processor to the ingest pipeline to parse the timestamp using the timezone included in `event.timezone`.
So in principle your events will include the timezone of your filebeat (`UTC`), but you want to use (`Europe/Paris`). One thing you can try is to add a processor that sets a different timezone for the events coming from your machines in France. Something like:
```auto
processors:
- if:
then:
- drop_fields.fields: ['event.timezone']
- add_fields.fields:
event.timezone: 'Europe/Paris'
```
If you want to do this with all your events then there is no need to have the `if/then` blocks.
---
### Author:  [@seatsea](https://discuss.elastic.co/u/seatsea)
#### Post date: [July 23, 2019, 9:52am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/3 "2019-07-23T09:52:56Z")
Thanks for the answer
Using your configuration, the timezone would appear separately like this:
```
"fields": {
"event": {
"timezone": "Europe/Paris"
}
}
```
So I used this configuration which seems to work
```
filebeat.modules:
- module: panw
panos:
enabled: true
var.syslog_host: 0.0.0.0
var.syslog_port: 9001
var.convert_timezone: true # I'm not sure if this is having any effect
processors:
- drop_fields.fields: ['event.timezone']
- add_fields:
target: event
fields:
timezone: 'Europe/Paris'
output:
elasticsearch:
hosts: ["es01:9200"]
setup.kibana:
host: "Kibana:5601"
```
However, the logs still have the incorrect timestamp. For example
"@timestamp": [
"2019-07-23T11:46:15.000Z"
],
When the local Paris time is 11:46
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [July 23, 2019, 10:17am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/4 "2019-07-23T10:17:34Z")
Oh, sorry for the mistake on the configuration, you are right 🙂
Can you check if the pipeline is making use of `event.timezone`? You may need to reinstall the pipeline if you changed the value of `var.convert_timezone`. Take a look to [this topic](https://discuss.elastic.co/t/filebeat-system-and-iptables-module-timezone-offset-issue/176732/2) for a similar issue with other module.
---
### Author:  [@seatsea](https://discuss.elastic.co/u/seatsea)
#### Post date: [July 23, 2019, 10:33am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/5 "2019-07-23T10:33:33Z")
Adding `filebeat.overwrite_pipelines: true` to the configuration seems to have done the trick as no new logs are being added with a time in the future.
Thanks for your help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2019, 10:33am UTC](https://discuss.elastic.co/t/panw-module-timezone-offset/191360/6 "2019-08-20T10:33:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.