[Elasticsearch] UTC 를 사용 하는 이유.

분명히 어디선가 공식 문서 또는 글을 봤는데 찾지를 못하겠습니다.

 

https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html

https://discuss.elastic.co/t/elastic-utc-time/191877

 

discuss 에 보면 elastic team member 가 코멘트 한 내용이 있습니다.

Elasticsearch doesn't have a native concept of a "pure" date, only of instants in time. 
Given that, I think that it is reasonable to represent a pure date as the instant of 
midnight UTC on that date. 
If you use a different timezone then you will encounter problems as some "dates" 
will not be a whole number of days apart, because of occasions 
when the clocks go forwards or back for daylight savings.

Formatting a date as an instant without an explicit timezone is probably a bad idea, 
because something somewhere will have to guess what timezone to use 
and you may get inconsistent results if those guesses are inconsistent. 
Always specify the timezone, and in this case I recommend UTC as I mentioned above.

When you run an aggregation involving times, 
you can tell Elasticsearch what timezone to use 27. 
It defaults to UTC according to those docs.

I do not, however, know how to get Kibana to interpret 
these dates as you want in a visualisation. 
It's probably best to ask on the Kibana forum for help with that.

그리고 reference 문서에는 아래와 같은 내용이 있습니다.

Internally, dates are converted to UTC (if the time-zone is specified) 
and stored as a long number representing milliseconds-since-the-epoch.

그냥 Elastic Stack 은 기본적으로 @timestamp 값을 저장 시 UTC 0 를 기준으로 저장을 한다고 이해 하시고 질의 시점에 변환을 하거나 별도 localtime 에 맞는 custum timestamp field 를 추가해서 사용하는게 정신 건강에 좋다고 생각 하십시오.

 

추가적으로,

 

Date Query 관련 질의 시 

- "time_zone" 파라미터 설정은 now 값에 영향을 주지 않습니다.

참고 하세요.