{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/3898","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/3898/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/3898/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/3898/events","html_url":"https://github.com/elastic/beats/issues/3898","id":219008639,"number":3898,"title":"Filebeat 'system' module assumes UTC in ingest pipeline","user":{"login":"inputvalidation","id":26655367,"avatar_url":"https://avatars0.githubusercontent.com/u/26655367?v=4","gravatar_id":"","url":"https://api.github.com/users/inputvalidation","html_url":"https://github.com/inputvalidation","followers_url":"https://api.github.com/users/inputvalidation/followers","following_url":"https://api.github.com/users/inputvalidation/following{/other_user}","gists_url":"https://api.github.com/users/inputvalidation/gists{/gist_id}","starred_url":"https://api.github.com/users/inputvalidation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inputvalidation/subscriptions","organizations_url":"https://api.github.com/users/inputvalidation/orgs","repos_url":"https://api.github.com/users/inputvalidation/repos","events_url":"https://api.github.com/users/inputvalidation/events{/privacy}","received_events_url":"https://api.github.com/users/inputvalidation/received_events","type":"User","site_admin":false},"labels":[{"id":294278645,"url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000","default":false},{"id":78874874,"url":"https://api.github.com/repos/elastic/beats/labels/enhancement","name":"enhancement","color":"fbca04","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-04-03T17:40:29Z","updated_at":"2018-04-01T02:50:55Z","closed_at":"2017-11-21T11:52:56Z","author_association":"NONE","body":"My initial question on ES discuss:\r\n\r\n> I'm using filebeat to import syslog messages. When looking at the ES document it appears filebeat incorrectly assumes UTC:\r\n> \r\n> ES document:\r\n> \r\n> \"@timestamp\": \"2017-04-01T15:26:51.000Z\"\r\n> Syslog message\r\n> \r\n> \"timestamp\": \"Apr 1 15:26:51\"\r\n> OS:\r\n> \r\n> Sat Apr 1 15:26:51 CEST 2017\r\n>\r\n> Should filebeat not store the @timestamp as 13:26:51?\r\n\r\nResponse from @tsg: \r\n\r\n> Thanks for the feedback, I think a variable for the timezone makes sense in this module. Could you open a Github ticket for it, please? It's not trivial to implement because currently we insert the pipelines \"as is\" without expanding variables into them, but I think that's something we can add.\r\n\r\nFor confirmed bugs, please report:\r\n- Version: 5.3.0\r\n- Operating System: Debian 8 (using ES repo)\r\n- Steps to Reproduce: add syslog messages in localtime using filebeat, messages are stored in UTC while the time is still localtime and not converted to UTC"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/377739132","html_url":"https://github.com/elastic/beats/issues/3898#issuecomment-377739132","issue_url":"https://api.github.com/repos/elastic/beats/issues/3898","id":377739132,"user":{"login":"oligarx","id":15272786,"avatar_url":"https://avatars3.githubusercontent.com/u/15272786?v=4","gravatar_id":"","url":"https://api.github.com/users/oligarx","html_url":"https://github.com/oligarx","followers_url":"https://api.github.com/users/oligarx/followers","following_url":"https://api.github.com/users/oligarx/following{/other_user}","gists_url":"https://api.github.com/users/oligarx/gists{/gist_id}","starred_url":"https://api.github.com/users/oligarx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oligarx/subscriptions","organizations_url":"https://api.github.com/users/oligarx/orgs","repos_url":"https://api.github.com/users/oligarx/repos","events_url":"https://api.github.com/users/oligarx/events{/privacy}","received_events_url":"https://api.github.com/users/oligarx/received_events","type":"User","site_admin":false},"created_at":"2018-04-01T02:50:55Z","updated_at":"2018-04-01T02:50:55Z","author_association":"NONE","body":"This is still an issue out of the box for 6.2.3 and only dbluxo's work-around seems to resolve the issue"}}
{"actor":{"display_login":"oligarx"}}