Daylight Saving timezone error

The configured timezone does not match the timezone of the incoming log files after Daylight Saving is implemented.

Symptoms

The configured timezone does not match the timezone of the incoming log files. Logstash does not recognize the new timezone associated with the log files, and does not process the files. Therefore, data ingestion is unsuccessful.

Cause

When Daylight Saving Time is implemented, the timezone that is associated with the incoming log files is altered to 1 hour behind or ahead. For example, when the log file timezone is set to Central European Time it changes automatically to Central European Summer Time for the summer months. Logstash does not process the records and no records reach Log Analysis.

Resolution

To resolve the timezone error, complete the following manual steps to ensure that the timezone of the incoming log files and the configured timezone are the same.
  1. Open the SCALAPATTERNS file.
  2. Edit the LATIMESTAMP pattern definition to match the updated timezone. For example, to change the timezone from Central European Time, to Central European Summer Time, edit the LATIMESTAMP pattern definition as follows.
    Central European Time
    LATIMESTAMP %{DATE_US} %{TIME} CET
    Central European Summer Time
    LATIMESTAMP %{DATE_US} %{TIME} CEST