Timestamped events not going to correct index up until 08:59:59.999 JST

Elastic Stack Beats
1

As the title implies, my timestamped events are being added to the wrong index everyday up until 08:59:59.999 JST.

Before 09:00:00 JST

 @timestamp     November 20th 2018, 08:59:59.835
 _index	      	     winlogbeat-6.4.0-2018.11.19

After 09:00:00 JST

 @timestamp     November 20th 2018, 09:00:58.491
 _index	      	     winlogbeat-6.4.0-2018.11.20

I can understand why this is happening, because my geographic location (Japan) is +9 hours ahead of UTC.

I'm wondering if this is normal behavior or not? If not, I'm wondering if it's possible to fix this by reindexing or is there some other more efficient method to solve this issue?

2

This is completly normal behaviour, all timestamps are saved as UTC in the Elastic Stack.
All datasources (Filebeat with modules, other beats or Logstash date filter) convert there local timestamp (timezone) to UTC in the resulting event.

3

Thanks! I was going through and looking for any issues while learning the stack and noticed this. Glad to know that it's normal behavior.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.