Convert timezones if event.timezone is set

[jsoriano]

Follow up of #12253

[ycombinator]

Changes to stack modules look good to me. Thanks @jsoriano! ❤️

[ruflin]

Change LGTM. I know wonder if we need to update the docs in some places as the conver_timezone config becomes obsolete?

[jsoriano]

Change LGTM. I know wonder if we need to update the docs in some places as the conver_timezone config becomes obsolete?

@ruflin It doesn't become obsolete yet, it is still used in filebeat to decide if event.timezone is set.

[ruflin]

@jsoriano Got it.

BTW I found a way where this could be a breaking change: For whatever reason without enabling convert_timezone the user had event.timezone field set. So not it starts converting. But I don't expect that this is an edge case we will hit so we should move forward here.

[jsoriano]

@ruflin looking for what could be setting the event.timezone field, I have found that the PosgreSQL module was parsing it from the logs, but not using it to parse the date, I have opened a separate PR for this: #12338
Do you know of other cases where event.timezone is set?
In any case take into account that timezone conversion using the timezone of the machine (in the event.timezone field) is only done in modules whose logs don't include a timezone.

[ruflin]

@jsoriano Not that I'm aware of. In any case, let's move forward with this PR.