Timestamp in document is different from shown in kibana

Elastic Stack Elasticsearch
1

Hello everyone!

I bet its something really basic but I dont want to waste any more time by trying to find the solution myself.
My issue is that in kibana the timestamp is correct and shows the correct time however in the elasticsearch document the timestamp is 2 hours behind.
Where the problem could be?I set the timezone in kibana and elasticsearch too.

Thanks in advance!

2

When Kibana shows standard timestamps it by default adjusts for the local timezone of the browser. All timestamps in Elasticsearch are in UTC time, so I guess you are in a timezone 2 hours off UTC?

3

Yeah I read about this and no I checked the browser and it is in the correct timezone and also as I said the browser and kibana shows me the correct time the 2 hours difference is in the elastic document.If I look at the json object of the document the correct time is not even included in the document itself(only the wrong timestamp with the -2 hours difference is included).The time is also correct on the host where the logs are coming from.

4

What is the timestamp you are seeing in Kibana? What is the timestamp in the JSON document? Which timezone are you in?

5

I'm in GMT+2.
image

image
image697×62 10.6 KB

6

Oh I think is just realised what yous answer meant in the first reply.
Is there a way to modify this behaviour(all timestamps are utc by default)?
My goal is to export the logs with logstash and timestamp is a bit off.
Should I manipulate that field after exporting the data?

7

All timestamps in Elasticsearch must be UTC. There is no way to change that.

If you need it in local timezone you will need to convert it from UTC once you have extracted it.

2 Likes