Problem with Timezone


(Carlos Barrera) #1

hi, I need help

the problem

I am using the logstash date filter, to assign the date from the log line, I need to use the timezone of my country Chile (America / Santiago) which is currently GMT-4, but when I review the data in kibana, @timestamp Figure as if it were timezone GTM-3

I know that @timestamp is stored in UTC and that the timezone in the date filter is only to calculate the date in UTC

example log line
20170726|180922|Current|0|0|0|0|0|0|

The date in log line is "20170726|180922" equivalent to 2017-07-26 18:09:22

Date filter used
Date{
Match => ["time", "yyyyMMdd '|' HHmmss"]
Timezone => "America / Santiago"
Remove_field => "time"
}

note: The time field is valid example "20170726|180922"

I have reviewed:
Tz-data, tzdata-java, tzinfo-data updated to the latest version
Date and server timezone ok
Date and timezone of java ok
kibana timezone ok

Versions
I test on Server Rhel7.1, Ubuntu 16.04 and Docker

Kibana 5.5
Logstasth 5.5
Elasticsearch 5.5
Filebeat 5.5

Try

I tried to use in logstash another timezone GTM-4 example (America / Aruba) which is GTM-4 and works fine, in kibana @timestamp is calculated with UTC-4

I do not know why the timezone America / Santiago logstash takes it as GTM-3, if it's America / Santiago is GTM-4 until the thirtieth of August

Date{
Match => ["time", "yyyyMMdd '|' 'HHmmss"]
Timezone => "America / Aruba"
Remove_field => "time"
}


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.