@timestamp Field Different In ElasticSearch from Index

The timestamp changes when viewed in Kibana/Elasticsearch from what is actually indexed.

The log parses and indexes as such

   {
  "_index": "cisco-fmc-000001",
  "_type": "_doc",
  "_id": "vVLsgG8BNS3R70DxVgt7",
  "_version": 1,
  "_score": null,
  "_source": {
    "HTTPReferer": "http://209.99.64.51/",
    "@timestamp": "2020-01-07T10:52:45.000Z",
.................................................
  },
  "fields": {
    "@timestamp": [
      "2020-01-07T10:52:45.000Z"
    ]
  },
  "sort": [
    1578394365000
  ]
}

However when viewing logs in Kibana/Elasticsearch @timestamp changes to a different time 04:52:45.000 effecting searches.

Kibana uses your browser settings to display dates according to your timezone.

Ah ok I adjusted the time within logstash back to UTC and that fixed the problem. Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.