Timezone problem, data displayed in the future


#1

Hi !

I'm new to Kibana and I looked for an answer but found nothing although this seems to be a popular topic.

I'm in France (UTC+1) and using Filebeat.
The problem is when a log is sent, say at 9:30 AM kibana shows it at 10:30 AM. If I check the document JSON the @timestamp is correct, but displayed differently..

Here is an example:
25

And the raw JSON:
36

Any thoughts ?

Thanks


(Christian Dahlqvist) #2

Timestamps in Elasticsearch has to be in UTC timezone, which is why the JSON document looks the way it does. When Kibana displays data it will adjust timestamps based on the browsers timezone, which is why it differs from the raw data, which is not modified by Kibana.


#3

Thanks for quick answer.

Indeed the @timestamp in the JSON is not UTC but UTC+1.
Do you know how can I change that ?

FYI heartbeat and metricbeat send correct UTC timestamp...
I just have this problem with filebeat.


#5

It was a filebeat configuration problem, so it's ok now.
Can close this topic :slight_smile: