# Syslog Dashboard Timezone Issue?

**URL:** <https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114>\
**Category:** Kibana\
**Created:** [March 29, 2018, 3:39pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114 "2018-03-29T15:39:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![copenlc](https://avatars.discourse-cdn.com/v4/letter/c/fbc32d/32.png) [@copenlc](https://discuss.elastic.co/u/copenlc)\
**Post date:** [March 29, 2018, 3:39pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114/1 "2018-03-29T15:39:14Z")

</div>

Hey guys would appreciate any help. I've been trying to setup my Syslog dashboard for the last few days and I think i finally narrowed down my issue but I cannot seem to figure out how to correct it. The issue looks like its a timezone offset issue within kibana ? I look at my JSON string and everything looks correct in terms of time. When I look at the table tab for an event everything is shifted by four hours, which would make sense because I'm EST timezone. Any Idea why this is happening and how to correct it so everything matches my Local Timezone ?

Kibana is running is 6.2.3 and on Centos 7. All server feeding data are Filebeat 6.2.3 and located on the same VM Farm as the kibana / elastic servers. All dashboards are stock and nothing has been adjusted.

```
{
  "_index": "filebeat-6.2.3-2018.03.29",
  "_type": "doc",
  "_id": "OXlfcmIBXBZ59wnDQAAV",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2018-03-29T11:27:42.000Z",
    "system": {
      "syslog": {
        "hostname": "atlptgnag-dev1",
        "program": "systemd",
        "message": "Starting User Slice of root.",
        "timestamp": "Mar 29 11:27:42"
      }
    },
    "offset": 229443,
    "beat": {
      "hostname": "atlptgnag-dev1",
      "timezone": "EDT",
      "name": "atlptgnag-dev1",
      "version": "6.2.3"
    },
    "prospector": {
      "type": "log"
    },
    "source": "/var/log/messages",
    "fileset": {
      "module": "system",
      "name": "syslog"
    }
  },
  "fields": {
    "@timestamp": [
      "2018-03-29T11:27:42.000Z"
    ]
  },
  "sort": [
    1522322862000
  ]
}

|@timestamp| |March 29th 2018, 07:27:42.000|
|---|---|---|
|t _id| |OXlfcmIBXBZ59wnDQAAV|
|t _index| |filebeat-6.2.3-2018.03.29|
|# _score| | - |
|t _type| |doc|
|t beat.hostname| |atlptgnag-dev1|
|t beat.name| |atlptgnag-dev1|
|t beat.timezone| |EDT|
|t beat.version| |6.2.3|
|t fileset.module| |system|
|t fileset.name| |syslog|
|# offset| |229,443|
|t prospector.type| |log|
|t source| |/var/log/messages|
|t system.syslog.hostname| |atlptgnag-dev1|
|t system.syslog.message| |Starting User Slice of root.|
|t system.syslog.program| |systemd|
|t system.syslog.timestamp| |Mar 29 11:27:42|
```

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [March 29, 2018, 10:01pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114/2 "2018-03-29T22:01:26Z")

</div>

In Advanced Settings you can set the timezone. That might resolve your issue.

---

<div class="post-metadata">

**Author:** ![copenlc](https://avatars.discourse-cdn.com/v4/letter/c/fbc32d/32.png) [@copenlc](https://discuss.elastic.co/u/copenlc)\
**Post date:** [March 30, 2018, 1:38pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114/3 "2018-03-30T13:38:16Z")

</div>

Hey Tyler tried to Adjust the Timezone with No effect. It only appears to be effecting this dashboard for some reason.

---

<div class="post-metadata">

**Author:** ![copenlc](https://avatars.discourse-cdn.com/v4/letter/c/fbc32d/32.png) [@copenlc](https://discuss.elastic.co/u/copenlc)\
**Post date:** [April 2, 2018, 2:55pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114/4 "2018-04-02T14:55:56Z")

</div>

Hey guys this was the solution to my issue looks like I had an existing pipeline causing issues. Solved with this threads help. Thanks guys !

> [@Filebeat 6.2.1 system module does not convert timestamp with timezone](https://discuss.elastic.co/t/filebeat-6-2-1-system-module-does-not-convert-timestamp-with-timezone/119668/2):
>
> The way the convert\_timezone feature works is by installing an Elasticsearch ingest pipeline to do this conversion. Unfortunately, if a previous ingest pipeline already exists, filebeat will not update it with the required changes to make convert\_timezone work. You need to delete the existing pipeline manually and restart filebeat: curl -XDELETE 'http://elasticsearch:9200/\_ingest/pipeline/filebeat-\*'

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2018, 2:56pm UTC](https://discuss.elastic.co/t/syslog-dashboard-timezone-issue/126114/5 "2018-04-30T14:56:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.