Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kibana Displays Timestamps Unintuitively #137652

Closed
Tracked by #163011
lukerucks opened this issue Jul 31, 2022 · 4 comments
Closed
Tracked by #163011

Kibana Displays Timestamps Unintuitively #137652

lukerucks opened this issue Jul 31, 2022 · 4 comments
Labels
Feature:FieldFormatters impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:DataDiscovery Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.

Comments

@lukerucks
Copy link

lukerucks commented Jul 31, 2022

It is my opinion that the Kibana handling of timestamps is very confusing. First I'll describe how Kibana currently handles them, then make a suggestion for what to do instead.

How Kibana currently handles timestamps:

Timestamps from log collectors are assumed to be in UTC. However, Kibana will display the times converted to the local time of the Kibana instance. The original (assumed to be UTC) timestamp can be seen in the JSON of any given document, but will be displayed in local time in table form.

TimestampJSON5424WithDrawing

The actual document matches that shown in the document’s JSON (which is always assumed to be UTC); the time shown in table form, the @timestamp field shown in table form, and the time shown in histograms all are converted to local time.

TimestampTable5424WithHighlights

If timestamps are provided with a time zone, this will automatically be converted to UTC. Because the timestamp is converted to UTC, this means that the event.timezone field will always be either “+00:00” or null. Unlike the timestamp, this will not be converted to local time in table form. Like the timestamp, the JSON form of the document will show that if the event.timezone field exists, it will be in UTC (i.e. always “+00:00”).

TimezoneTable
(Explanation of above) To get the displayed timestamp from the original event, first the original timestamp 2020-03-01T11:02:36+10:00is converted to UTC. This is stored as the document’s timestamp; here, it would be stored in the document as"@timestamp": "2020-03-01T01:02:36.000Z". From here, the display convers the UTC timestamp to the local time; being in Central Daylight Time (UTC-05:00), this ends up with the date Feb 29, 2020 @ 19:02:36.000

Complaint

It is in now way obvious that the timestamp is being converted to local time for Kibana, but is not converted in the document itself. It is also very confusing that the event.timezone is not converted, when you would expect it to be if the timstamp itself is.

Proposal

Add in some label in at least the histogram and table showing that implies the displayed times are shown in local time but stored in UTC. This could be as simple as including the local timezone (e.g. UTC-05:00 or CDT) in the histogram time labels and in the time and @timestamp fields in table form.

I am admittedly much less certain that I have a good solution than I am in the unacceptability of the status quo.

@botelastic botelastic bot added the needs-team Issues missing a team label label Jul 31, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-app-services (Team:AppServicesSv)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Aug 12, 2022
@rashmivkulkarni rashmivkulkarni added the Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience) label Aug 12, 2022
@Dosant
Copy link
Contributor

Dosant commented Aug 15, 2022

@lukerucks, thanks for the write-up and the proposal.

I'd like to mention an advanced setting to disable time conversion to browser timezone. This probably could make it less confusing for your case.

Screenshot 2022-08-15 at 14 43 45

(cc @elastic/shared-ux see the idea about being explicit everywhere about the timezone)

@exalate-issue-sync exalate-issue-sync bot added the impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. label Aug 17, 2022
@petrklapka petrklapka added Feature:FieldFormatters Team:DataDiscovery Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. and removed Team:AppServicesSv labels Dec 12, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

@petrklapka petrklapka removed the Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience) label Dec 12, 2022
@kertal
Copy link
Member

kertal commented Aug 9, 2023

We are closing this in order to provide better transparency of priorities. This issue won't be prioritized in the near future.
We track it in #163011 for longer term planning.

@kertal kertal closed this as completed Aug 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:FieldFormatters impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:DataDiscovery Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.
Projects
None yet
Development

No branches or pull requests

6 participants