Timezone of kibana logs should be same host's timezone

Elastic Stack Kibana
#1

We are using ELK 7.8.0 version and want to have kibana logs in the same timezone as host's timezone.
In this topic "Changing the timezone of logs written in logging.dest in kibana.yml" it is suggested to use logging.useUTC parameter to disable UTC format and use local timezone. However, for 7.8 version we have logging.timezone parameter but it requires a canonical timezone id and in our case we need it to automatically have the same timezone from local. So, Is there any way to configure logs to have same timestamp as local timezone?

Thanks.

#2

Hello pratiksha, I don't fully understand the issue yet, can you clarify please?

We are using ELK 7.8.0 version and want to have kibana logs in the same timezone as host's timezone.

Ie. you don't want to use the default, which is the use of UTC time stamps, ie. your plan was to use logging.useUTC: false right? As of 7.0 the logging.useUTC is no longer valid so if I understand, you're looking at logging.timezone.

for 7.8 version we have logging.timezone parameter but it requires a canonical timezone id

So if I understand, you want to avoid the explicit assignment of timezone. Is it for convenience, or is there some other reason for it? Just trying to understand the use case.

So, Is there any way to configure logs to have same timestamp as local timezone?

Local, in reference of what exactly? You mention "host" on top. Various servers in the stack can be in diverse time zones, so I'd like to clarify the exact component you refer to, as I'm not familiar with your setup.

#3

Yes, we are using logging.timezone parameter to set the timezone in logs.
We have a usecase where we need to have the timezone of the host and kibana logs should be same.
Like, logging.timezone should be able to pick the timezone from '/etc/localtime' in the host to get the timezone.
Is there anyway that this can be configured?

#4

Thanks for the added detail, I'm not aware of such option post 7.0. Is this value changing over time btw.? I don't yet fully understand the situation. Can't you just set the logging.timezone to the time zone of the host? Wouldn't it be analogous to using logging.useUTC: false pre 7.0?

#5

Thanks for the reply, yes we can set the logging.timezone to the timezone of the host. But in one of the scenario in containerized environment we are setting pod's timezone to be picked from /etc/localtime of server machine and similarly we also need to set logging.timezone value to have same value from /etc/localtime, so that logs can be in the same timezone.
Please suggest if there is any way we can configure this.

#6

As I assume it's at discrete points in time when you change /etc/localtime, probably via a script, is it possible for you to update the logging.timezone simultaneously?

#7

We are mounting the /etc/localtime of server inside the pod to update /etc/localtime of container, but we cannot do the same for logging.timezone since it takes only timezone id as its value. That is why need to have some other way to update logging.timezone value.

Thanks

#8

Please suggest if there is any way through which we can achieve this.

Thanks