# \[Still Not Solved!\] Filebeat cannot recognize timezone in syslog

**URL:** <https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 29, 2019, 9:37am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661 "2019-07-29T09:37:27Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![cosloli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosloli/32/51115_2.png) [@cosloli](https://discuss.elastic.co/u/cosloli)\
**Post date:** [July 30, 2019, 10:14am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/22 "2019-07-30T10:14:41Z")

</div>

I have deleted `filebeat-7.2.0-system-syslog-pipeline` and `filebeat-7.2.0-system-auth-pipeline`

Then I ran filebeat using the configuration like this:

```auto
/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat -E filebeat.overwrite_pipelines=true

```

Then I use `GET /_ingest/pipeline?pretty`, but I couldn't find any new pipeline created.

The whole pipeline list after restarting the filebeat is [here](https://www.laotiehui.cc/pipeline.json).

---

<div class="post-metadata">

**Author:** ![cosloli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosloli/32/51115_2.png) [@cosloli](https://discuss.elastic.co/u/cosloli)\
**Post date:** [July 30, 2019, 10:17am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/23 "2019-07-30T10:17:37Z")

</div>

well... my apology, the new pipeline has been created, and it has a `timezone` property!  
I looked further and found that only these pipelines have the `timezone` property:

```auto
filebeat-7.2.0-system-syslog-pipeline (recreaeted)
filebeat-7.2.0-system-auth-pipeline (recreated)
filebeat-7.2.0-elasticsearch-server-pipeline
filebeat-7.2.0-elasticsearch-slowlog-pipeline
filebeat-7.2.0-elasticsearch-audit-pipeline

```

Is that normal?

Unluckily, the `@timestamp` in syslogs are still incorrect... The timezone configuration in syslog now is like:

```
"timezone" : "{{ event.timezone }}"
```

---

<div class="post-metadata">

**Author:** ![cosloli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosloli/32/51115_2.png) [@cosloli](https://discuss.elastic.co/u/cosloli)\
**Post date:** [July 31, 2019, 4:44am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/24 "2019-07-31T04:44:03Z")

</div>

There's other developers facing the same problems as mine! I hope you could figure out the problem and fix it. It will be so helpful.

> [@On another topic](https://discuss.elastic.co/t/192656/2):
>
> Hi,
> 
> I am still unable to solve this issue. Hence, i had to turn off the elasticsearch module due to this bug. It seems like the `var.convert_timezone` does not work well where it converts the timezone into UTC to store into elasticsearch.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [July 31, 2019, 5:37am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/25 "2019-07-31T05:37:24Z")

</div>

Hello,

I have the same problem on Filebeat's elasticsearch module but it work's fine for the system module.  
Let me share what i have done to fix it. However, my ELK stack is on development and not for production, hence following my procedure might cause loss of data.

My server timezone is in UTC +8:00 (Singapore)  
Enabling `var.convert_timezone: true` converts my server timezone into UTC, which means - 8 hours.  
On Kibana, `Timezone for date formatting` was left as default where it reads the timezone of the browser and +8 hours back from UTC.  
Hence, showing the correct timing.

**Re-indexing and Recreating Pipeline**

1. Stop Filebeat **on all instance** that utilize the old pipeline

2. $ systemctl stop filebeat

3. Enable UTC time conversion in system.yml

4. Delete pipelines

5. $ curl -XDELETE '[http://esnode1:9200/\_ingest/pipeline/filebeat-\*](http://esnode1:9200/_ingest/pipeline/filebeat-*)'

6. Delete Related Indicies @ Index Management

7. Since the logs shown in kibana are in wrong time, we should reindex all the logs

8. In kibana, navigate to management \> index management \> select the index that stores the server logs

9. Delete it

10. Recreate the index

11. $ filebeat setup -e

12. $ filebeat setup --pipelines -modules="system"

13. Restart filebeat

14. $ systemctl start filebeat

15. Observer logs tab on kibana and it should show logs with the correct timing.

---

<div class="post-metadata">

**Author:** ![cosloli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cosloli/32/51115_2.png) [@cosloli](https://discuss.elastic.co/u/cosloli)\
**Post date:** [July 31, 2019, 6:02am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/26 "2019-07-31T06:02:04Z")

</div>

Alright! I'll have a try. I have the problem on system as well as elasticsearch LOL.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2019, 6:05am UTC](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661/27 "2019-08-28T06:05:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/still-not-solved-filebeat-cannot-recognize-timezone-in-syslog/192661.md?page=1)