Thumbs up to ^. I'd check to make sure where this is happening, it looks like something at the ingest layer may be parsing the timezone. If you take a look at the raw json in your index curl -XGET evbooking-2018.07.09/_search you can see what it looks like without Kibana in the way.