Open jguay opened 7 months ago
Hello, a solution can be also to take in account the field event.timezone in the logs-redis pipeline.
Indeed, by using - add_locale: ~ as processor on Redis Integration, we have the event.timezone field set but has no effect on timestamp of the logs due to a missing configuration in the ingest pipeline.
To fix it , we need the event.timezone as variable in the ingest pipeline logs-redis.log-1.14.0
( like fo example in cisco-asa pipeline )
any news ? The issue is still present on new pipeline version logs-redis.log-1.15.0
redis integration will ingest logs from redis server Redis logs are not UTC - they use the local server timezone... So if redis server does not use UTC, the timestamp of logs are wrong
Potential workaround is to edit the redis ingest pipeline to add a date processor adding a
Timezone
offset in either of these ingest pipelines :logs-redis.integration@custom
logs-redis.log@custom
This issue is to request for a feature in UI exactly like Cisco ASA integration exposing
Timezone
in UI when configuring redis integration - screenshot from Cisco ASA integration to illustrate :