[Filebeat] Enabled convert_timezone in tests by default in tests (elastic#12123)

In elastic#12120 a default timezone (UTC) is introduced for the tests. This allows us to enabled `convert_timezone` in all tests. It guarantees that we also test the data conversion part in the pipelines.

No timestamps changed because they were already assumed in UTC when no timezone is set.

Author: ruflin

filebeat/module/elasticsearch/audit/test/test-access.log-expected.json

@@ -6,6 +6,7 @@
         "elasticsearch.audit.layer": "rest",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 0,
@@ -23,6 +24,7 @@
         "elasticsearch.node.name": "v_VJhjV",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 155,
@@ -42,6 +44,7 @@
         "elasticsearch.audit.request.name": "ClearScrollRequest",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 306,
@@ -58,6 +61,7 @@
         "elasticsearch.node.name": "v_VJhjV",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 519,
@@ -73,6 +77,7 @@
         "elasticsearch.audit.layer": "rest",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 654,
@@ -92,6 +97,7 @@
         "elasticsearch.audit.request.name": "MainRequest",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 802,
@@ -108,6 +114,7 @@
         "elasticsearch.node.name": "v_VJhjV",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "http.request.body.content": "body",
         "input.type": "log",
@@ -143,6 +150,7 @@
         "elasticsearch.node.name": "NodeName-0",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 1210,
@@ -161,6 +169,7 @@
         "elasticsearch.node.name": "node-0",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "http.request.body.content": "{\"metadata\":{\"intelligence\":7},\"full_name\":\"Jack Nicholson\",\"roles\":[\"admin\",\"other_role1\"",
         "input.type": "log",

filebeat/module/elasticsearch/audit/test/test-audit.log-expected.json

@@ -8,6 +8,7 @@
         "event.action": "authentication_failed",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 0,
@@ -28,6 +29,7 @@
         "event.action": "authentication_failed",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 274,
@@ -54,6 +56,7 @@
         "event.action": "access_granted",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 558,
@@ -79,6 +82,7 @@
         "event.action": "access_granted",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 941,
@@ -104,6 +108,7 @@
         "event.action": "access_granted",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 1309,
@@ -132,6 +137,7 @@
         "event.action": "access_granted",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "input.type": "log",
         "log.offset": 1676,
@@ -154,6 +160,7 @@
         "event.action": "authentication_success",
         "event.dataset": "elasticsearch.audit",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "audit",
         "http.request.body.content": "\n{\n    \"query\" : {\n        \"term\" : { \"user\" : \"kimchy\" }\n    }\n}\n",
         "http.request.method": "GET",

filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json

@@ -5,6 +5,7 @@
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -18,6 +19,7 @@
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -31,6 +33,7 @@
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -44,6 +47,7 @@
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",

filebeat/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json

@@ -5,6 +5,7 @@
         "elasticsearch.component": "o.e.d.c.ParseField",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -18,6 +19,7 @@
         "elasticsearch.component": "o.e.d.c.ParseField",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -31,6 +33,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -44,6 +47,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -57,6 +61,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -70,6 +75,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -83,6 +89,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -96,6 +103,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -109,6 +117,7 @@
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -122,6 +131,7 @@
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -135,6 +145,7 @@
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -148,6 +159,7 @@
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -161,6 +173,7 @@
         "elasticsearch.component": "o.e.d.s.a.InternalOrder$Parser",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -174,6 +187,7 @@
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -187,6 +201,7 @@
         "elasticsearch.component": "o.e.d.i.m.MapperService",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -200,6 +215,7 @@
         "elasticsearch.component": "o.e.d.i.m.MapperService",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",

filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json

@@ -9,6 +9,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -26,6 +27,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -43,6 +45,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -60,6 +63,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -77,6 +81,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -94,6 +99,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -111,6 +117,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -128,6 +135,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -145,6 +153,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -162,6 +171,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -179,6 +189,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -196,6 +207,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",
@@ -213,6 +225,7 @@
         "elasticsearch.node.name": "es1_1",
         "event.dataset": "elasticsearch.deprecation",
         "event.module": "elasticsearch",
+        "event.timezone": "+00:00",
         "fileset.name": "deprecation",
         "input.type": "log",
         "log.level": "WARN",