This module parses logs that don’t contain time zone information. For these logs,
Filebeat reads the local time zone and uses it when parsing to convert the
timestamp to UTC. The time zone to be used for parsing is included in the event
in the event.timezone field.
To disable this conversion, the event.timezone field can be removed with
the drop_fields processor.
If logs are originated from systems or applications with a different time zone to
the local one, the event.timezone field can be overwritten with the original
time zone using the add_fields processor.
See [filtering-and-enhancing-data] for information about specifying processors in your config.