Unexpected behavior with date fields in Elasticsearch

Bogota/Colombia is on UTC-5, so what you are seeing is consistent with the way dates works in Elasticsearch.

As mentioned, all date fields in Elasticsearch will be stored in UTC, so it is expected that all date fields being sent to Elasticsearch are already in UTC or have the timezone offset information.

When this is not the case you will have wrong dates in Elasticsearch, to avoid this you need to convert your date to UTC before sending it or send the timezone offset in the date string.

If you send just 2024-03-18 to elasticsearch, it will assume that this is 2014-03-18 00:00:00Z, which is not the case, and then Kibana will convert this back to the browser timezone which in your case will be UTC -5.

So, in this case it will convert to 2024-03-17 19:00:00, which is the equal to UTC minus 5.

You didn't say how you are indexing your data, just the format, but what are you using to send the data to elasticsearch?

You need to fix this in the ingestion by telling Elasticsearch that your date is not on UTC.

You will need to send your date string as something like this, 2023-03-18 00:00:00-05:00 and not just the month.

1 Like