Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kibana Server time and PC time doesn’t match #11038

Closed
kahveci opened this issue Apr 5, 2017 · 10 comments
Closed

Kibana Server time and PC time doesn’t match #11038

kahveci opened this issue Apr 5, 2017 · 10 comments
Labels
bug Fixes for quality problems that affect the customer experience Team:Operations Team label for Operations Team

Comments

@kahveci
Copy link

kahveci commented Apr 5, 2017

Kibana version: 5.2.0 and 5.3.0

Elasticsearch version: 5.2.0 and 5.3.0

Server OS version: Windows 10

Browser version: 57.0.2987.133

Browser OS version: Windows 10

Original install method: download page

Description of the problem including expected versus actual behavior:
I have a strange problem. Basically, when I run Kibana Server, its server time and my PC's local time doesn't match. The problem has started appearing recently -- not sure but maybe, just after daylight saving time 2017 in the UK last weekend.

kibana-server-time

I realised that after seeing my documents stored at wrong timestamp via Kibana. When I search them directly through ES APIs, timestamp looks correct. However, in Kabana, timestamp looks one hour ahead. For example, a document stored at 09:00.00 looks 10:00:00. Therefore, you cannot retrieve data using "last 15 minutes" pre-defined time range.

I have checked Kibana -> Advanced Settings -> dateFormat:tz (Default: Browser)

I replaced the default value (Browser) with "UCT", and this allowed me to see the correct timestamp at Kibana. But, the time range feature (e.g. discover data 'last 15 minutes' etc.) still doesn't work. So, I always have to define an absolute date-time, or a wider range predefined datetime such as "today". Also, I don't understand why I should play with advanced settings. Because everything was pretty much perfect by default values before.

Steps to reproduce:
n/a

@jbudz
Copy link
Member

jbudz commented Apr 5, 2017

Kibana's server timestamp will use UTC time. Kibana's browser timestamps by default(Browser in advanced settings) will request using your current timezone.

Can you share an example of one of your timestamps in elasticsearch? Checking for what the timezone looks like.

@kahveci
Copy link
Author

kahveci commented Apr 5, 2017

Mapping for timestamp in Kibana:
"@timestamp": {"type": "date", "format": "yyyy-MM-dd HH:mm:ss.SSS"

Example timestamp entry in elasticsearch:
{"@timestamp":"2017-04-03 14:45:42.552"}

@tbragin tbragin added Team:Operations Team label for Operations Team bug Fixes for quality problems that affect the customer experience labels Apr 10, 2017
@kahveci
Copy link
Author

kahveci commented May 5, 2017

This morning, I tested new Kibana v5.4 on different PCs. Unfortunately, the same behaviour continues. As a result, Kibana doesn't work properly to visualise data considering the time filter provided.

@rdalbuquerque
Copy link

Hello, I'm currently using the kibana 5.6 with the exact same issue. Any updates on it?
PS: I'm in Brasil

@jbudz
Copy link
Member

jbudz commented Oct 11, 2017

I did some digging, starting in 5.0 it looks like we started intentionally logging in UTC with #8534. Can you verify that this is "correct" for you?

If it is I'll close this out so we can merge the discussion with the enhancement request for local tz logs at #12175

@kahveci
Copy link
Author

kahveci commented Oct 17, 2017

I tested the same scenario using the latest (5.6.3) Elasticsearch and Kibana today. As @jbudz said, Kibana console logs are set in UTC intentionally. However, I don't think this is a good idea for an enterprise application. At least, there should be a configuration in kibana.yml allowing us to change it considering the requirements of our system.

Apart from this, I reckon the second part of my post is more interesting. In default settings, Kibana shows my stored documents in wrong timestamp. For instance, when I store a document with timestamp like "October 17th 2017, 15:34:10.150", I see the same record on Kibana Discover tab as having timestamp "October 17th 2017, 16:34:10.150" even though Elasticsearch has it with the right timestamp.

I am able to fix this by playing with Advanced Settings (dateFormat:tz) and list it on Discover tab as it is supposed to be. But this leads to another problem. Kibana changes its system time and I cannot use Time Range options properly.

@chupasaurus
Copy link

I'm seeing this odd behaviour on Kibana 6.2.2.
Elasticsearch has timestamps in UTC, Kibana Discover shows timestamps in UTC, however "Last N" time range is calculated from local timezone of server (i.e. local tz of server is UTC+4, if I try to show docs in "Last 24 hours", the most recent ones would be in 4 hours prior to current time of server).

@JaviPG
Copy link

JaviPG commented Apr 24, 2018

@chupasaurus I have the same problem. I'm looking for the root of this problem too.

My scenario is using 5.4.1 (ELK)

@jay00929
Copy link

Looks like this is a bug, i am facing this issue for Kibana 6.2 also.

@koksalb
Copy link

koksalb commented Aug 1, 2018

I can't believe this bug is still ongoing for 6.3.1 Changing tz from kibana does not help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team:Operations Team label for Operations Team
Projects
None yet
Development

No branches or pull requests

8 participants