# Time incorrect from system module (syslog) **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 28, 2018, 5:22pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905 "2018-02-28T17:22:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Post date:** [February 28, 2018, 5:22pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/1 "2018-02-28T17:22:44Z")
Beats and ES 6.2.2 When we enable the System module the time of syslog entries in Kibana shows as UTC appearing 5 hours old. The syslog entries themselves have the correct EST time. If we enable log watching in the filebeat.yml for \*.log in var/log/ the times of say UFW and Auth show correctly in Kibana. We are not doing any time manipulation with the filebeat.yml or the system.yml file. ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [February 28, 2018, 9:47pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/2 "2018-02-28T21:47:29Z")
Elasticsearch stores all "time" fields in UTC/Epoch a couple things could be going on. The simplest of them. Kibana uses the Timezone of your browser to display the timezone. Are you talking about the \_timestamp field or your own field? Is that field of type string or time? If that does help to answer your problem please provide some of the json data from Elastic so we can see what your talking about ---
**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Post date:** [February 28, 2018, 10:34pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/3 "2018-02-28T22:34:50Z")
Kibana is using browser timezone and logs like ufw and auth to show correctly in Kibana. When viewing the timeline in Kibana the current syslog logs (system module) being displayed are 5 hours behind as opposed to the auth and ufw logs (configured in filebeat.yml) which are being written at the current time. We're not using custom fields. Everything is vanilla at this point. ## Example syslog doc: @timestamp February 28th 2018, 12:16:37.000 \_index filebeat-6.2.2-2018.02.28 \_score - \_type doc beat.name es-01 beat.version 6.2.2 fileset.module system fileset.name syslog offset 5,651,821 prospector.type log source /var/log/syslog system.syslog.hostname XXXXXXXXXXXXXXXXX system.syslog.message {"type":"response","@timestamp":"2018-02-28T22:16:37Z","tags":[],"pid":19682,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"connection":"upgrade","host":"XXXXXXXXXXXXXXXXX","x-real-ip":"XXXXXXXXXXXXXXXXX","x-forward-for":"XXXXXXXXXXXXXXXXX, XXXXXXXXXXXXXXXXX","x-forward-proto":"http","x-nginx-proxy":"true","accept-encoding":"gzip","cf-ipcountry":"US","x-forwarded-for":"XXXXXXXXXXXXXXXXX","cf-ray":"3f46bfd07ab157b3-IAD","x-forwarded-proto":"https","cf-visitor":"{"scheme":"https"}","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/_,_/\*;q=0.8","referer":"[https://XXXXXXXXXXXXXXXXX/app/kibana","accept-language":"en-US,en;q=0.9","cf-connecting-ip":"XXXXXXXXXXXXXXXXX"},"remoteAddress":"127.0.0.1","userAgent":"127.0.0.1","referer":"https://XXXXXXXXXXXXXXXXX"},"res":{"statusCode":200,"responseTime":3,"contentLength":9},"message":"GET](https://XXXXXXXXXXXXXXXXX/app/kibana%22,%22accept-language%22:%22en-US,en;q=0.9%22,%22cf-connecting-ip%22:%22XXXXXXXXXXXXXXXXX%22%7D,%22remoteAddress%22:%22127.0.0.1%22,%22userAgent%22:%22127.0.0.1%22,%22referer%22:%22https://XXXXXXXXXXXXXXXXX%22%7D,%22res%22:%7B%22statusCode%22:200,%22responseTime%22:3,%22contentLength%22:9%7D,%22message%22:%22GET) /ui/favicons/favicon-16x16.png 200 3ms - 9.0B"} system.syslog.pid 19682 system.syslog.program kibana system.syslog.timestamp Feb 28 17:16:37 ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [March 1, 2018, 2:29am UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/4 "2018-03-01T02:29:36Z")
The Data looks right > {"type":"response","@timestamp":"2018-02-28T22:16:37Z" I am not sure what the other data outside of the JSON data is because the first @timestamp at the top is 12:16:37 which is 10 hours different but system.syslog.timestamp Feb 28 17:16:37 but is not part of the json so not sure where that is from. Maybe the formatting from the website is screwed up. you can use the code statement to show it. Ok yah the system.syslog.timestamp, if you want that to be in sync with the @timestap you need to convert it from a string field to a time/date field. Not sure in filebeat how to do that. I use logstash and that would just be a simple "date" filter, I am sure you could do it in a pipeline too. The READ time is @timestamp (UTC) and the log date value was the time it was written to messages at whatever the time zone is > **[Configure logging | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html)** What does your raw log file format look like , in the config doc I see the Timezone in the syslog example but your info provided does not show a timezone in the system.syslog.timestamp ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 1, 2018, 3:08am UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/5 "2018-03-01T03:08:34Z")
When the syslog host doesn't use UTC for its timezone then a conversion is needed. The system module has an option for this called [convert\_timezone](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html#_literal_syslog_literal_fileset_settings). You need to delete the existing pipeline for the change to take effect. See: [Filebeat 6.2.1 system module does not convert timestamp with timezone](https://discuss.elastic.co/t/filebeat-6-2-1-system-module-does-not-convert-timestamp-with-timezone/119668/2?u=andrewkroh) ---
**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Post date:** [March 1, 2018, 1:30pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/6 "2018-03-01T13:30:13Z")
Still confused so let me ask it a different way - Why do the logs like UFW and Auth that are being monitored from the filebeat.yml showing correctly in Kibana? I've stood up another fresh box with ES and out of the box syslog is off by 5 hours in Kibana but the syslog itself is correct. ---
**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Post date:** [March 1, 2018, 2:39pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/7 "2018-03-01T14:39:03Z")
Just to follow up. It is working now but I am confused as to why the difference from monitoring via the filebeat.yml and the system.yml 1. Stop Filebeat 2. Enable UTC time conversion in system.yml 3. Delete pipelines 4. Restart filebeat Works now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 29, 2018, 2:39pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905/8 "2018-03-29T14:39:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.