Adding timezone support in ECS

ECS is currently missing timezone support.

We used to have fields where the value should be defined as a differential in seconds, which we agreed to remove, as it was not very friendly (device.timezone.offset.sec and host.timezone.offset.sec).

In order to re-introduce the timezone, we need to pick a field name, and what values we support in there.

Fun facts:

• Beats can either output:
  • a time differential in hh:mm format (e.g. -05:00)
  • or in abbreviated form (e.g. EST).
• Ingest Node supports at least 3 input formats:
  • time differentials in hh:mm format
  • abbreviated timezones
  • canonical timezones (e.g. Europe/Amsterdam)
• Logstash’s date filter supports 2 formats, according to the docs:
  • time differentials in hh:mm format
  • canonical timezones (e.g. Europe/Amsterdam)

Here are a few questions that could help shape the direction here:

• Can someone confirm whether Beats emits the correct time differential immediately after DST changes?
• Should we limit which format goes into the timezone field to only one format, or let people use their preferred format, as long as it’s one of the 3?
• What field name(s) seem more appropriate?

@MikePaquette @ruflin @andrewkroh

[ruflin]

You mean event.timezone?

[webmat]

Awesome. Will get that going shortly. I agree with event.timestamp