Timezone related issue

[Pranjal_Sett]

Hello Again,

I am getting as actual data for the attribute(FILE_CREATION_DATE) as "2022-06-30 16:34:27" but when I see in the kibana table format; I can see the time has been added exactly two hours. Here is the data in kibana Table : FILE_CREATION_DATE Jun 30, 2022 @ 18:34:27.000.

timezone : "Europe/Stockholm"

In index template my custom format for the datetime field is : yyyy-MM-dd HH:mm:ss.

How can I get the actual time in kibana also? Is there anyhow I can mention in the Index template so that it should not added exactly 2 hours.

Regards,
Pranjal Sett

[RabBit_BR (andre.coelho)]

Hi @Pranjal_Sett

Change timezone here: Kibana > Management > Advanced Settings -> Timezone for date formatting

[Pranjal_Sett]

Hi @RabBit_BR

Did that change but issue still persists.

[stephenb (Stephen Brown)]

Hi @Pranjal_Sett

How are you ingesting your data?

Most likely the problem is that you're ingesting this FILE_CREATION_DATE date field without a time zone and so the default is to assume UTC timezone.

At ingestion time you should provide the time zone for that for that field then I think you'll see what you expect.

A date field in elastic is always stored as UTC and then displayed in Kibana in the local time zone (assuming default settings)

[Pranjal_Sett]

@Pranjal_Sett

yyyy-MM-dd HH:mm:ss

Hi @stephenb ,

In that case I have to write this logic in Logstash like below:

date {
match => ["FILE_CREATION_DATE" , "yyyy-MM-dd HH:mm:ss"]
timezone => "Europe/Stockholm"
}

remove the custom date format for FILE_CREATION_DATE from index template then delete the index and restart the logstash .. right?

[stephenb (Stephen Brown)]

That sounds about right.

You Could probably update the index template to have the new / correct date format If you wanted.