I would argue that users expect that information from the Filebeat system module is indexed using the correct timezone. However, users currently need to explicitly set var.convert_timezone: true to get the results that I would expect to be the default.

For this reason, I would propose to change the default to var.convert_timezone: true.