I get worng time data in my index in kibana there is around lot of difference in @timestamp and log_timestamp field.
grok filter which i am using
grok {
match => [ "message" , '%{IP:remote_addr} - - \[%{HTTPDATE:log_timestamp}\] "%{IPORHOST:http_host}" "%{WORD:request_method} %{DATA:uri} HTTP/1.1" %{NUMBER:response} %{NUMBER:bytes} (?:%{DATA:http_refer}|-) %{QS:agent} "(?:%{IPV4:upstream_addr}|-)" (?:%{NUMBER:upstream_connect_time}|-) (?:%{NUMBER:upstream_header_time}|-) (?:%{NUMBER:upstream_response_time}|-) (?:%{NUMBER:request_time}|-)' ]
overwrite => [ "message" ]
}
mutate {
convert => ["response", "integer"]
convert => ["bytes", "integer"]
convert => ["responsetime", "float"]
rename => ["agent", "filebeat_agent" ]
}
geoip {
source => "remote_addr"
add_tag => [ "nginx-geoip" ]
}
date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => [ "timestamp" ]
# target => "@timestamp"
}
useragent {
source => "agent"
}
}
}
To push log from client i am using filebeat nginx module with some fields. See below attached image you can see time difference in index