Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[filebeat] Add convert_timezone to nginx module #9839

Closed
pc-jedi opened this issue Jan 2, 2019 · 2 comments · Fixed by #10148
Closed

[filebeat] Add convert_timezone to nginx module #9839

pc-jedi opened this issue Jan 2, 2019 · 2 comments · Fixed by #10148
Assignees
Labels
Filebeat Filebeat module Team:Integrations Label for the Integrations team

Comments

@pc-jedi
Copy link

pc-jedi commented Jan 2, 2019

Currently the nginx module does not have a convert_timezone configuration option.
Since Kibana assumes a timestamp field to be stored as UTC in ES, you will see your logs having a wrong timestamp.
This would not be a big issue.
But if you have configured your server timezone to UTC+1 and insert a nginx log with [02/Jan/2019:10:00:00 +0100], which is 9AM UTC, the @timestamp will be 10AM UTC.
If you now want to see your log in Kibana this will not be possible, because queries in Kibana are limited by the current timestamp. Therefore you have to wait util it is 10AM UTC to be able to see your log in Kibana.

The easiest workaround for that would be setting your server timezone to UTC, which I don't like.

It would be nice to have something like the system module convert_timezone.

Since there are also some more module, which don't have this option it would be the best to add this to all modules.

@jsoriano jsoriano added module Filebeat Filebeat Team:Integrations Label for the Integrations team labels Jan 3, 2019
@kaiyan-sheng
Copy link
Contributor

This seems to be a subtask for #9993

@pc-jedi
Copy link
Author

pc-jedi commented Feb 2, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Filebeat Filebeat module Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants