The timestamp is there but if the logsource doesn't contain TZ information within it I have no way of knowing if the TZ of the source data was GMT, EST, etc... ... View more

The timezone the indexer assigns to the log source prior to converting to UTC (or whatever) when it stores it in the index. ... View more

I checked a few indexes and I'm not seeing a date_zone field anywhere. If I could find that field or something similar that would definitely be my option. Any reason it wouldn't be there? Edit: I may have answered my own question Note: Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that. ... View more