From e5124f2e4cc6c1f07604bd0efa52c1260baddcbb Mon Sep 17 00:00:00 2001
From: Shaunak Kashyap <ycombinator@gmail.com>
Date: Wed, 13 Mar 2019 05:12:47 -0700
Subject: [PATCH] Cherry-pick #11164 to 6.6: Use beat.timezone instead of
 event.timezone (#11195)

Cherry-pick of PR #11164 to 6.6 branch. Original message:

In 6.x the `add_locale` processor will [set the `beat.timezone` field](https://github.com/elastic/beats/blob/6.7/libbeat/processors/add_locale/add_locale.go#L89) (as opposed to `event.timezone`, which is [set starting 7.0](https://github.com/elastic/beats/blob/master/libbeat/processors/add_locale/add_locale.go#L89)). So any 6.x ingest pipelines looking for the timezone field should look for `beat.timezone`, not `event.timezone`.

Fixes #11055.
---
 CHANGELOG.next.asciidoc                                        | 2 ++
 filebeat/module/elasticsearch/audit/ingest/pipeline.json       | 2 +-
 filebeat/module/elasticsearch/deprecation/ingest/pipeline.json | 2 +-
 filebeat/module/elasticsearch/server/ingest/pipeline.json      | 2 +-
 filebeat/module/elasticsearch/slowlog/ingest/pipeline.json     | 2 +-
 filebeat/module/logstash/log/ingest/pipeline-plain.json        | 2 +-
 filebeat/module/logstash/slowlog/ingest/pipeline-plain.json    | 2 +-
 7 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 5a7a96a3741..dc3f1b92a33 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -36,6 +36,8 @@ https://github.com/elastic/beats/compare/v6.6.2...6.6[Check the HEAD diff]
 
 *Filebeat*
 
+- Fix a bug with the convert_timezone option using the incorrect timezone field. {issue}11055[11055] {pull}11164[11164]
+
 *Heartbeat*
 
 *Journalbeat*
diff --git a/filebeat/module/elasticsearch/audit/ingest/pipeline.json b/filebeat/module/elasticsearch/audit/ingest/pipeline.json
index 6e1d5be7e21..02678cc4eaf 100644
--- a/filebeat/module/elasticsearch/audit/ingest/pipeline.json
+++ b/filebeat/module/elasticsearch/audit/ingest/pipeline.json
@@ -64,7 +64,7 @@
                 "formats": [
                     "ISO8601"
                 ],
-                {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+                {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
                 "ignore_failure": true
             }
         },
diff --git a/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json b/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json
index 8f126f11e2f..c1e09e668f2 100755
--- a/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json
+++ b/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json
@@ -33,7 +33,7 @@
                 "formats": [
                     "ISO8601"
                 ],
-                {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+                {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
                 "ignore_failure": true
             }
         },
diff --git a/filebeat/module/elasticsearch/server/ingest/pipeline.json b/filebeat/module/elasticsearch/server/ingest/pipeline.json
index 8cdd7935341..77a165388c0 100755
--- a/filebeat/module/elasticsearch/server/ingest/pipeline.json
+++ b/filebeat/module/elasticsearch/server/ingest/pipeline.json
@@ -34,7 +34,7 @@
                 "formats": [
                     "ISO8601"
                 ],
-                {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+                {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
                 "ignore_failure": true
             }
         },
diff --git a/filebeat/module/elasticsearch/slowlog/ingest/pipeline.json b/filebeat/module/elasticsearch/slowlog/ingest/pipeline.json
index 1d2f4d78870..52817649ee7 100644
--- a/filebeat/module/elasticsearch/slowlog/ingest/pipeline.json
+++ b/filebeat/module/elasticsearch/slowlog/ingest/pipeline.json
@@ -26,7 +26,7 @@
               "formats": [
                   "ISO8601"
               ],
-              {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+              {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
               "ignore_failure": true
           }
       },
diff --git a/filebeat/module/logstash/log/ingest/pipeline-plain.json b/filebeat/module/logstash/log/ingest/pipeline-plain.json
index 74c4bed15d1..f7a7caf31d1 100644
--- a/filebeat/module/logstash/log/ingest/pipeline-plain.json
+++ b/filebeat/module/logstash/log/ingest/pipeline-plain.json
@@ -40,7 +40,7 @@
                 "formats": [
                   "ISO8601"
               ],
-              {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+              {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
               "ignore_failure": true
             }
         },
diff --git a/filebeat/module/logstash/slowlog/ingest/pipeline-plain.json b/filebeat/module/logstash/slowlog/ingest/pipeline-plain.json
index ba7c1f5903c..af330e5c311 100644
--- a/filebeat/module/logstash/slowlog/ingest/pipeline-plain.json
+++ b/filebeat/module/logstash/slowlog/ingest/pipeline-plain.json
@@ -55,7 +55,7 @@
                 "formats": [
                   "ISO8601"
               ],
-              {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >}
+              {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
               "ignore_failure": true
             }
         },