Use TimeZone.getDefault as default time zone

[rfoltyns]

Use TimeZone.getDefault as default time zone

[rfoltyns]

Done.

[rfoltyns]

If you specify the time zone, index names will always be fine, cause the name is formatted by time-zoned FastDateFormat, there's no risk that logs will land in the wrong index.

However, due to the limitations of Log4j2 PatternProcessor (time zone can't be specified, TimeZone.getDefault() is always used), currentTime and nextRolloverTime will not be set properly when using time zone other that default and RollingIndexNameFormatter may fallback to non-cached indexName path and generate a bit more garbage than it should.

As for the logevent timestamps - querying might be affected, especially if you search from <date_in_the_past> until now() - in some scenarios, if Kibana is not configured properly, some events may not be found. There are lots of issues and discussions about it and I haven't found a suitable solution for that.

Bottom line is: whatever zone you use - machine default, UTC or any other - make sure that you can still get proper results and/or adjust your queries accordingly :) In the end, it was a nicely spotted bug and hopefully usage of TimeZone.getDefault() will bring more good results than damage :)

[rfoltyns]

Time zones are tricky.. ES assumes that timestamps come in UTC by default, so it will have implications one way or the other.
Nevertheless, I've changed the default to machine time. Let's test it out.

[rfoltyns]

I ran into some issues. I have to revert it and do some more testing on that. Can you stick to explicitly specified timezone for a while?

[thaarbach]

@rfoltyns

ES assumes that timestamps come in UTC by default, so it will have implications one way or the other.

Thats true, but how impact the time zone for generating the index name the logevent time stamp?

[thaarbach]

Ah, that's make it clear. Thank you for your explanation.

I've checked if the RollingIndexNameFormatter without set a zone explictly. Now, it works as expected 👍

[rfoltyns]

Fantastic news. Thanks :)
I'll release it this weekend.

[thaarbach]

@rfoltyns
Cool, so i close this issue.