Problems with EST5EDT timezone in Kibana 7.17.0

[lifer (Oleksii Samodid)]

Hi team!

I have some problems with EST5EDT timezone in Kibana v 7.17.0:

So, when I set timezone to UTC on the "Slack Management -> Advanced Settings" page - everything works fine and I see data with correct timezone. But when I set timezone to EST5EDT - data is displayed in my browser timezone.

I tried to set it back and forth to EST5EDT manually a few times, and behavior was kind of random: graphs on my dashboard were alternating between EST5EDT and my browser timezone (GMT+3) :

All good with UTC:

I wonder if it has to do something with daylight savings, because I'm sure about a week ago it was working fine.

Let me know what kind of debug information I need to provide to proceed with this issue.

Thanks!

[flash1293 (Joe Reuter)]

Is this happening for all charts in Kibana (including user-created dashboards) or is it about a certain app only?

[lifer (Oleksii Samodid)]

This seem to be happening only in one specific space. Btw, that space was initially imported from other kibana.

[flash1293 (Joe Reuter)]

By space you mean the Kibana space and all visualizations (including custom dashboards) in this space?

[lifer (Oleksii Samodid)]

yes, it's reproducible only in one kibana space.

[flash1293 (Joe Reuter)]

Could you export the dashboard via saved object management and upload it here?

[lifer (Oleksii Samodid)]

here you go: export.ndjson - Google Drive

[flash1293 (Joe Reuter)]

I can't see anything unexpected in there. Does the problem persist after clearing the cache and reloading the dashboard (or opening it in a private browsing window?)

[lifer (Oleksii Samodid)]

yep, check the screenshot (incognito window):

some graphs are EST5EDT, and some are GMT+3 (my browser timezone)

discover tab also shows data in my local tz

[flash1293 (Joe Reuter)]

Could you test setting your time zone to America/New_York or US/Eastern?

[lifer (Oleksii Samodid)]

I see the data in my local browser timezone for both of timezones you provided

[markov00 (Marco Vettorello)]

Hi @lifer can I ask you two more things to check:

1. can you tell me what browser you are using and what version of it?
2. can you check with this page What is my Timezone? :: WebBrowserTools what is your current browser timezone configured?
   Thanks

[lifer (Oleksii Samodid)]

Google Chrome Version 100.0.4896.60 (Official Build) (arm64)

[markov00 (Marco Vettorello)]

Thanks for reporting this and for staying with us on investigating the problem.
I'd like to check few more things on your end to frame better the problem:

1. do you have any particular browser extension that can interfere with the page (like Tampermonkey)
2. if you open to edit one of the visualizations that is showing the time in the wrong timezone, do you see same problem?
3. can you click on the gear icon on top/right corner of a good and a bad visualization and click Inspect, then View: Requests and then switch to the Request tab. Can you please share copies of the requests for a good and bad visualizations? (please hide/remove everything that can't be publicly shared)

[lifer (Oleksii Samodid)]

1. do you have any particular browser extension that can interfere with the page (like Tampermonkey)

No. I just checked with my phone, same issue.

2. if you open to edit one of the visualizations that is showing the time in the wrong timezone, do you see same problem?

yes, on lens edit screen data also has my local timezone

3. can you click on the gear icon on top/right corner of a good and a bad visualization and click Inspect, then View: Requests and then switch to the Request tab. Can you please share copies of the requests for a good and bad visualizations? (please hide/remove everything that can't be publicly shared)

I can't find a good visualization right now, all of them show data in my local TZ. This one is for bad visualization:

  "aggs": {
    "0": {
      "date_histogram": {
        "field": "timestamp",
        "fixed_interval": "30s",
        "time_zone": "US/Eastern"
      }
    }
  },
  "size": 0,
  "fields": [
    {
      "field": "processed_at",
      "format": "date_time"
    },
    {
      "field": "timestamp",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "event": "autocomplete"
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "range": {
            "timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2022-04-12T19:35:32.165Z",
              "lte": "2022-04-12T19:50:32.165Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

What's interesting, is that on the response tab I see dates in correct timezone:

            "key_as_string": "2022-04-12T15:42:00.000-04:00",
            "key": 1649792520000,
            "doc_count": 318
          },

[markov00 (Marco Vettorello)]

Thanks @lifer
The requests look correct, I don't see any problem here. I also checked the exported saved object and also there I don't see any issue at all related to some improperly configured timezone.
I tried to replicate the issue locally on a 7.17.0 instance, importing and exporting visualizations and dashboards from different spaces/kibana instances with different timezone and I can't replicate the behaviour.
I can keep looking at what is going on but it's hard if we can't replicate it on our side.
I have a few more questions to see if something else comes out:

• Do you see any error on the chrome dev console that can be related to that problem?
• You already probably know that, but it worth trying: the timezone configuration on the advanced setting is per Space, so if this is reproducible only in one space, it means that this space can be compromized some how. Can you double check that the advanced settings you are changing is the one related to the space where the dashboard and visualizations are saved? I know it sounds obvious, but sometimes you are operating with spaces with similar logos/icons/color and you can confuse them (this doesn't solve the problem related to the fact that only some viz are showing time in a different timezone but it's worth trying)
• what happen if you recreate from scratch one visualization? does it follows the timezone configured?

[lifer (Oleksii Samodid)]

• Do you see any error on the chrome dev console that can be related to that problem?
  
  
  
  that's all I have in console when opening the dashboard

Can you double check that the advanced settings you are changing is the one related to the space where the dashboard and visualizations are saved?

yeah, I'm sure, checked many times...

• what happen if you recreate from scratch one visualization? does it follows the timezone configured?

created new dashboard, added new vis, same problem

[lifer (Oleksii Samodid)]

I've also created a new space, did export / import of dashboards and index patterns - same issue