# UTC vs EST log events in Kibana **URL:** \ **Category:** Logstash\ **Created:** [February 19, 2021, 11:02pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921 "2021-02-19T23:02:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Yuri\_Sibirski](https://avatars.discourse-cdn.com/v4/letter/y/4491bb/32.png) [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Post date:** [February 19, 2021, 11:02pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/1 "2021-02-19T23:02:53Z")
Hi there. I was not able to find a solution for my problem that is why I am creating this post. My problem is that we are sending logs to elasticsearch from linux nodes using either UTC or EST as their timezones. For EST nodes logs in Kibana are being displayed according to the time, but for linux nodes using UTC timezone I need to set my time for FUTURE(Next 5 hours) in Kibana in order to see the latest logs. My logstash filer is the following, but I am not even sure if Logstash is the one that needs to be fixed for this. > root@centralizedlogging:/etc/logstash/conf.d# cat 10-syslog-filter.conf > filter { > if [type] == "syslog" { > grok { > match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } > add\_field =\> ["received\_at", "%{@timestamp}"] > add\_field =\> ["received\_from", "%{host}"] > } > syslog\_pri { } > date { > match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] > } > } > } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 19, 2021, 11:15pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/2 "2021-02-19T23:15:07Z")
> [@Yuri\_Sibirski](#): > > date { > match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] > } You would have to change that to ``` if (some condition) { date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } else { date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] timezone => "US/Eastern" } } ``` You will need to write a conditional that tests some field or fields on the event to see if they are UTC and sends them through the first branch. ---
**Author:** ![Yuri\_Sibirski](https://avatars.discourse-cdn.com/v4/letter/y/4491bb/32.png) [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Post date:** [February 22, 2021, 8:10pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/3 "2021-02-22T20:10:52Z")
Thank you for quick response. I think I like this approach, what CONDITION should I be checking on if my entire filter right now looks like this? Should I be checking in my CONDITION if logs are coming from UTC then ..... else timezone =\> "US/Eastern"? Thank you in advance. ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} % {SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 22, 2021, 8:19pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/4 "2021-02-22T20:19:23Z")
> [@Yuri\_Sibirski](#): > > what CONDITION should I be checking Hard to say. You say some hosts are UTC and some are US/Eastern. You need some test to tell you what timezone a given event is in. It would be possible to test the hostname that sent it, but depending on the rest of your configuration there may be other ways. For example, if the events are being shipped by filebeat you may be able to have filebeat tag them at source. Again, if you are using beats you might be able to send all of the UTC events to one port and all of the US/Eastern events to another, then tag them with the input. There are any number of possibilities. ---
**Author:** ![Yuri\_Sibirski](https://avatars.discourse-cdn.com/v4/letter/y/4491bb/32.png) [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Post date:** [February 22, 2021, 8:26pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/5 "2021-02-22T20:26:31Z")
Thank you very much. I do use filebeat to send logs from our linux nodes. Now, that I know the source of my issue I can start fixing it. Thank you again @Badger. Best, Yuri. ---
**Author:** ![Yuri\_Sibirski](https://avatars.discourse-cdn.com/v4/letter/y/4491bb/32.png) [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Post date:** [February 24, 2021, 4:09pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/6 "2021-02-24T16:09:45Z")
Thank you for your help @Badger. I was able to add field inside filebeat configuration and use that field for condition. It is working as charm now. ``` #Filebeat config fields: timezone: EST #Logstash config filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } if [fields][timezone] == "EST" { date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] timezone => "US/Eastern" } } else { date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] timezone => "UTC" } } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 24, 2021, 4:10pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921/7 "2021-03-24T16:10:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.