elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
37 stars 449 forks source link

[redis] add Timezone option to integration #9767

Open jguay opened 7 months ago

jguay commented 7 months ago

redis integration will ingest logs from redis server Redis logs are not UTC - they use the local server timezone... So if redis server does not use UTC, the timestamp of logs are wrong

Potential workaround is to edit the redis ingest pipeline to add a date processor adding a Timezone offset in either of these ingest pipelines :

This issue is to request for a feature in UI exactly like Cisco ASA integration exposing Timezone in UI when configuring redis integration - screenshot from Cisco ASA integration to illustrate : Screenshot 2024-05-01 at 10 48 03

jelmokri commented 6 months ago

Hello, a solution can be also to take in account the field event.timezone in the logs-redis pipeline.

Indeed, by using - add_locale: ~ as processor on Redis Integration, we have the event.timezone field set but has no effect on timestamp of the logs due to a missing configuration in the ingest pipeline.

To fix it , we need the event.timezone as variable in the ingest pipeline logs-redis.log-1.14.0

( like fo example in cisco-asa pipeline )

Screenshot from 2024-05-02 10-16-00

jelmokri commented 3 months ago

any news ? The issue is still present on new pipeline version logs-redis.log-1.15.0