Hello,
After upgrading the ELK stack to 7.6.0 (from elastic APT repos) my logs are displayed with incorrect @timestamp in Kibana.
Im using the vanilla apache module that ships with filebeat.
The Apache access logs are with UTC offset:
[24/Feb/2020:10:09:09 +0100] "GET /server-status?auto HTTP/1.1" 200 1358 "-" "Wget/1.19.4 (linux-gnu)"
In Elastic this row is stored as @timstamp 24/Feb/2020:09:09
Ingest processor reads the date-timecolumn apache.access.time and set it to @timestamp, then removes the field apache.access.time
{
"date" : {
"field" : "apache.access.time",
"target_field" : "@timestamp",
"formats" : [
"dd/MMM/yyyy:H:m:s Z"
],
"ignore_failure" : true
}
},
{
"remove" : {
"field" : "apache.access.time",
"ignore_failure" : true
}
},
I tried to debug and removed the removal of apache.access.time from the ingest processor to verifiy, and apache.access.time is showing correct timestamp.
What is going on here? Why isnt the UTC offset being honored when setting the @timestamp value any more?