grok parsefalure

[WillemDH]

Hey Jesse,

The remove_tag command did work. I guess this is ok for me. Could you just have a look at my question earlier in this thread concerning the timestamp being one hour off?

Grtz

[jolson]

Please run the following, using your appropriate timezone after the '-z' argument:

Code: Select all

/usr/local/nagioslogserver/scripts/change_timezone.sh -z America/Example

This will set an appropriate time for the logstash Daemon - let me know if this helps to fix your issue. Thanks Willem!

[WillemDH]

Jesse,

Done. I'll see if it helps and let you know.

Grtz

[jolson]

Sounds great, thanks Willem.

[WillemDH]

Jesse,

Seem I still have some one hour off timestamps.. Check screenshot:

The strange thing it that it's only wrong in the expanded detail @timestamp

A bug?

Grtz

Willem

[scottwilkerson]

The expanded @timestamp is showing the time ending in Z which is GMT and +1 hour from your actual timezone.

[WillemDH]

Ah Sry I didn't knew that. So whenever I see a timestamp with trailing Z, this is always in GMT + 1?

Grtz

Willem

[jolson]

'Z' stands for Zulu time, which is also GMT and UTC. This means that if you see a trailing 'Z', the time will always match GMT.

[WillemDH]

ok, thanks for the info. This thread can be closed.

[jolson]

Great - thanks Willem!