Re: [syslog-ng] Syslog-ng input for beats ?

Hi, On Fri, May 12, 2017 at 06:38:46AM -0400, Scot wrote:

I don't get it, I don't have that in my current ES target for syslog.

Kibana and most other frontends and maybe even libraries use the query's time to infer the index name: syslog-ng_${YEAR}.${MONTH}.${DAY} in your example. They use UTC timezone to do that. If you use localtime, like in your example (implicit) documents having 00:30 as timestamp for example will end up in the wrong index, and this will also depend on DST. When you search for them in kibana you might end up with wrong results. TL;DR: use time-zone("UTC") in your elasticsearch destination whenever you use time-based indices. Maybe we should even add that to the default SCL.