Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ES/Logstash log modules use wrong field to convert timezone #11055

Closed
LoadingZhang opened this issue Mar 4, 2019 · 4 comments
Closed

ES/Logstash log modules use wrong field to convert timezone #11055

LoadingZhang opened this issue Mar 4, 2019 · 4 comments
Assignees
@ycombinator
Labels
bug Feature:Stack Monitoring Filebeat Filebeat module

Comments

@LoadingZhang
Copy link

  • Version: Filebeat 6.6.1
    I see ES/Logstash pipeline use event.timezone to convert timezone, but acutlly only beat.timezone added to ES, so default pipleline can not execute date processor.
    see the pipeline code
@ruflin ruflin added Filebeat Filebeat Team:Integrations Label for the Integrations team module labels Mar 4, 2019
@andrewkroh
Copy link
Member

We use event.timezone for 7.0+. So probably something got backported without being adjusted for 6.x.

@andrewkroh andrewkroh added the bug label Mar 5, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/stack-monitoring

@ruflin ruflin removed the Team:Integrations Label for the Integrations team label Mar 6, 2019
@cachedout
Copy link
Contributor

I think this is the same as #9797

@ycombinator ycombinator self-assigned this Mar 7, 2019
@ycombinator ycombinator mentioned this issue Mar 8, 2019
Merged
ycombinator added a commit that referenced this issue Mar 11, 2019
@ycombinator
Use beat.timezone instead of event.timezone (#11164)
065ccc4 
In 6.x the `add_locale` processor will [set the `beat.timezone` field](https://github.com/elastic/beats/blob/6.7/libbeat/processors/add_locale/add_locale.go#L89) (as opposed to `event.timezone`, which is [set starting 7.0](https://github.com/elastic/beats/blob/master/libbeat/processors/add_locale/add_locale.go#L89)). So any 6.x ingest pipelines looking for the timezone field should look for `beat.timezone`, not `event.timezone`.

Fixes #11055.
@ycombinator ycombinator mentioned this issue Mar 11, 2019
Merged
ycombinator added a commit that referenced this issue Mar 13, 2019
@ycombinator
Cherry-pick #11164 to 6.6: Use beat.timezone instead of event.timezone (
e5124f2 
#11195)

Cherry-pick of PR #11164 to 6.6 branch. Original message: 

In 6.x the `add_locale` processor will [set the `beat.timezone` field](https://github.com/elastic/beats/blob/6.7/libbeat/processors/add_locale/add_locale.go#L89) (as opposed to `event.timezone`, which is [set starting 7.0](https://github.com/elastic/beats/blob/master/libbeat/processors/add_locale/add_locale.go#L89)). So any 6.x ingest pipelines looking for the timezone field should look for `beat.timezone`, not `event.timezone`.

Fixes #11055.
@ycombinator
Copy link
Contributor

Resolved via #11164.

leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@ycombinator
Cherry-pick elastic#11164 to 6.6: Use beat.timezone instead of event.…
e680395 
…timezone (elastic#11195)

Cherry-pick of PR elastic#11164 to 6.6 branch. Original message: 

In 6.x the `add_locale` processor will [set the `beat.timezone` field](https://github.com/elastic/beats/blob/6.7/libbeat/processors/add_locale/add_locale.go#L89) (as opposed to `event.timezone`, which is [set starting 7.0](https://github.com/elastic/beats/blob/master/libbeat/processors/add_locale/add_locale.go#L89)). So any 6.x ingest pipelines looking for the timezone field should look for `beat.timezone`, not `event.timezone`.

Fixes elastic#11055.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ycombinator ycombinator

Labels
bug Feature:Stack Monitoring Filebeat Filebeat module
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@ycombinator @cachedout @ruflin @andrewkroh @LoadingZhang @elasticmachine