Kibana 3 and support for timezones

[pinesr]

Are there any plans to support @timestamp in UTC time so that when I am on my Workstation (that is in EST time) I can see the most recent logstash entries and not those that are 4 hours or older. The only way I can reach those records is to put in custom date time range and I keep having to change it so that I can keep up with current logs every day. I see two options:

1. Allow the user to select a start date in the future instead of now to back....
2. Allow the user to chose the timezone that timestamp is in so that Kibana can correct for it and present current log information (even though the Workstations might be in EST time etc ...) .

Note: The feature of selecting 1,2,6,12,24 hours ago ...etc is useless when I have to use a custom time to get to the current logs.

Awaiting your reply,

Thanks

Steve P.

[rashidkpc]

Most users ship @timestamp in UTC, this sounds like some other issue. Kibana sends all time filters to Elasticsearch in UTC, it sounds like you might have a machine with the wrong time set somewhere.

[pinesr]

I will check this again but here is an example of what I was seeing.

It is 0700 EST time I login to my workstation open the web browser and pull up Kibana

At this point it is 1100 UTC time.

When I query Kibana it shows me records with timestamps ...0700-400 and any selection back in time from there.

When I queried Elasticsearch it returns as expected events that are dated ...1100-400

So the records are there but Kibana doesn't display then with the normal preset (available) dropdown time selectors.

Also if I set a custom time range in the future EST time then the records show up on Kibana.

No selections unchecking local checkbox help solve this.

The bottom line is my workstation is running EST time and sets up the time range based on the time it sees.

Logstash is (appropriately) timestamping entries in UTC time the time of the logs on that system.

I await your reply/suggestions ... perhaps I am missing something ...

Thanks

Steven R. Pine
pinesr@hotmail.com

P.S. Otherwise Logstash and Kibana as a front end work great. Thanks :)

Date: Mon, 7 Apr 2014 11:24:41 -0700
From: notifications@github.com
To: kibana@noreply.github.com
CC: pinesr@hotmail.com
Subject: Re: [kibana] Kibana 3 and support for timezones (#1124)

Most users ship @timestamp in UTC, this sounds like some other issue. Kibana sends all time filter to Elasticsearch in UTC, it sounds like you might have a machine with the wrong time set somewhere.

—
Reply to this email directly or view it on GitHub.

[rashidkpc]

Again, it really sounds like you have a node that has the wrong time set somewhere. The shipping system you describe is used by every logstash user, the only time we've seen this issue come up is when some machine has the wrong time. I'd check your elasticsearch node first.

[pinesr]

Just to make sure I understand what you are saying...

I verified all my timestamps for logs coming from systems that are in UTC time are in UTC time.

Even though I am bringing up Kibana on a web browser from a worstation that is set to EST time I should be able to say now (lets say again now is 0700 AM EST ) and 6h back and Kibana will display with entries with @timestamps dated 1100AM UTC and back 6 hours (to 0500AM UTC).

Steven R. Pine
pinesr@hotmail.com

Date: Tue, 8 Apr 2014 15:11:57 -0700
From: notifications@github.com
To: kibana@noreply.github.com
CC: pinesr@hotmail.com
Subject: Re: [kibana] Kibana 3 and support for timezones (#1124)

Again, it really sounds like you have a node that has the wrong time set somewhere. The shipping system you describe is used by every logstash user, the only time we've seen this issue come up is when some machine has the wrong time. I'd check your elasticsearch node first.

—
Reply to this email directly or view it on GitHub.

[rashidkpc]

Right, Kibana does everything in UTC. Its show you your local time, but in reality all of its interaction with Elasticsearch is in UTC

[pinesr]

Ok thanks .... I will check this again to try and see what is going on.

Steven R. Pine
pinesr@hotmail.com

Date: Tue, 8 Apr 2014 15:25:25 -0700
From: notifications@github.com
To: kibana@noreply.github.com
CC: pinesr@hotmail.com
Subject: Re: [kibana] Kibana 3 and support for timezones (#1124)

Right, Kibana does everything in UTC. Its show you your local time, but in reality all of its interaction with Elasticsearch is in UTC

—
Reply to this email directly or view it on GitHub.

[dhawani]

Replying for actual title of this issue. Please refer #95 (comment)

[pinesr]

I checked the Workstation and it is set as it is suppose to as EST time.
I also verified the server where logstash and ES are running and they are all set to UTC time.
All timestamp in logstash/ES are in UTC time.
So I verified again today that Kibana when you use the timepicker is it using the workstation time EST.
If I select 6 hours ago to a few seconds ago it sets the filter time to 2014-04-10 07:38:44.000 to 2014-04-10 13:38:44.000
Note: The workstations time when I picked the time range was 13:38:44 EST
So I get records back but only up to 13:38:44 UTC time.
Since all records are in UTC I have records timestamped up to 17:38:44 but I can't see them without choosing from the timepicker a custom setting like 2014-04-10 07:38:44.000 to 2014-04-10 23:38:44.000 and then I can see them.
Note: That custom time only works until I reach 2014-04-10 23:38:44.000 since I can't say now +6 or now +4 ...etc
The Kibana version is 3.0.0-3a485aa
I have no idea why Kibana is working the timepicker off the local workstation time (in the configuration of the timepicker I have no way to tell it not to use local workstation time as another way of possibly correcting this problem.
If Kibana used the server time (for the timepicker) that would work as well.
Awaiting your reply,
Steve P.

Date: Tue, 8 Apr 2014 15:11:57 -0700
From: notifications@github.com
To: kibana@noreply.github.com
CC: pinesr@hotmail.com
Subject: Re: [kibana] Kibana 3 and support for timezones (#1124)

Again, it really sounds like you have a node that has the wrong time set somewhere. The shipping system you describe is used by every logstash user, the only time we've seen this issue come up is when some machine has the wrong time. I'd check your elasticsearch node first.

—
Reply to this email directly or view it on GitHub.

[stonith]

See issue #977. The timepicker custom time range only works in browser time which causes confusion because the histogram and table panels can be configured for UTC.

[pinesr]

So I did some more poking around on the systems (after reading a somewhat obsure note in the logstash documentation about the /etc/sysconfig/clock file).

1. The time on the system was (reflecting GMT in the value returned using the date command).
2. However the ZONE in the clock file was set to EST not GMT.

The results of the clock file being set to EST instead of GMT was 2 fold:

1. Kibana would not display the most recent four hours of events because to it these events were in the future.
2. Logstash would create the index for the next day at 2000hrs GMT and continue to add entries for the previous day into it for the next 4 hours.

Setting the clock file ZONE="GMT" fixed both issue noted above.

Something that has this affect might be better included in a caution in the installation documentation than buried in the date filter in the timezone section.

I am including this information in the email because I have seen other emails about about logstash creating the index early ...etc.

So far you product is turning out to be a greater product and adding a caution about the setting in the system clock file might make the experience of others less confusing when your product expects and uses certain setting on the server.

Thanks again for your replies they were very helpful.

Steve P.

Date: Tue, 8 Apr 2014 15:25:25 -0700
From: notifications@github.com
To: kibana@noreply.github.com
CC: pinesr@hotmail.com
Subject: Re: [kibana] Kibana 3 and support for timezones (#1124)

Right, Kibana does everything in UTC. Its show you your local time, but in reality all of its interaction with Elasticsearch is in UTC

—
Reply to this email directly or view it on GitHub.

[phani546]

Hi All,
My Results are storing in es with UTC timezone.when i implemented kibana graphs in 4 it is not showing correct results with out changing timezone of my system to UTC.can we make graphs display in UTC timezone with out changing machine timezone.

Thanks,
phani