_time is 6hrs behind but the event time is real time.

[sathiyasun]

I have this props.conf TIME is almost 6hrs off from the event time. Below is my props.

[app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=^
TZ=US/Central

Sample log:-

This is event time which is ingesting fine "2023-11-14 10:59:58Z"

2023-11-14 10:59:58Z stevelog Closed Successfully
2023-11-14 10:59:58Z stevelog_close
2023-11-14 10:59:58Z Resetting CWD back from C:\WINDOWS\SysWOW64\inetsrv
2023-11-14 10:59:58Z Resetting CWD complete, back too C:\WINDOWS\SysWOW64\inetsrv
2023-11-14 10:59:58Z steveEngineMain Thread ====================> END

The actual TIME is 6hrs how than event time. Please find the attached screen and request you to let me know what the time difference.

[richgalloway · Accepted solution]

It looks correct.  The events are timestamped in UTC, but the props.conf says to convert times to Americas/Chicago, which is 6 hours behind UTC.

I recommend changing the props to extract the time zone from the timestamp.

[app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S%Z
TIME_PREFIX=^