diff --git a/ansible/group_vars/control.yml b/ansible/group_vars/control.yml
index d8fde12b..6cdffb41 100644
--- a/ansible/group_vars/control.yml
+++ b/ansible/group_vars/control.yml
@@ -2,6 +2,8 @@
 ##########################
 # fluentbit configuration
 ##########################
+
+
 # Fluentbit_inputs
 fluentbit_inputs:
   - Name: tail
@@ -16,6 +18,14 @@ fluentbit_inputs:
     Path_key: log_file
     DB: /run/fluent-bit-syslog.state
     Parser: syslog-rfc3164-nopri
+
+# Fluentbit_filters
+fluentbit_filters:
+  - name: lua
+    match: "*"
+    script: /etc/td-agent-bit/adjust_ts.lua
+    call: local_timestamp_to_UTC
+
 # Fluentbit Elasticsearch output
 fluentbit_outputs:
   - Name: es
@@ -39,4 +49,4 @@ fluentbit_custom_parsers:
     Time_Key: time
     Time_Format: "%b %d %H:%M:%S"
     Time_Keep: false  # Remove duplicated time field, avoid elasticsearh processing error
-    Time_Offset: "+0200"  # Add TimeZone UTC offset
+#    Time_Offset: "+0200"  # Add TimeZone UTC offset
diff --git a/ansible/k3s_deploy.yml b/ansible/k3s_deploy.yml
index 7ca22549..ed00db8b 100644
--- a/ansible/k3s_deploy.yml
+++ b/ansible/k3s_deploy.yml
@@ -35,15 +35,15 @@
       tags: ['certmanager']
     - role: longhorn
       tags: ['longhorn']
-    - role: logging
+    - role: logging/k3s
       tags: ['logging']
 
-- name: Deploy fluentbit on Pi Cluster Gateway
-  hosts: gateway
+- name: Deploy fluentbit on control nodes (gateway and pimaster)
+  hosts: control
   gather_facts: true
   tags: [logging]
   vars:
     ansible_become: true
   roles:
-    - role: ricsanfre.fluentbit
+    - role: logging/external_node
       tags: ['logging']
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
index 73af78b3..97968a3a 100644
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -17,7 +17,7 @@ roles:
   - name: ricsanfre.k8s_cli
     version: v1.0.0
   - name: ricsanfre.fluentbit
-    version: v1.0.2
+    version: v1.0.3
 collections:
   - name: kubernetes.core
     version: 2.1.1
diff --git a/ansible/roles/logging/external_node/tasks/main.yml b/ansible/roles/logging/external_node/tasks/main.yml
new file mode 100644
index 00000000..00181c7a
--- /dev/null
+++ b/ansible/roles/logging/external_node/tasks/main.yml
@@ -0,0 +1,10 @@
+---
+# Deploy fluentbit
+- name: Deploy fluentbit.
+  include_role:
+    name: ricsanfre.fluentbit
+  vars:
+    # lua scripts
+    fluentbit_lua_scripts:
+      - name: adjust_ts.lua
+        content: "{{ lookup('template','templates/adjust_ts.lua') }}"
diff --git a/ansible/roles/logging/external_node/templates/adjust_ts.lua b/ansible/roles/logging/external_node/templates/adjust_ts.lua
new file mode 100644
index 00000000..0c9fcfcd
--- /dev/null
+++ b/ansible/roles/logging/external_node/templates/adjust_ts.lua
@@ -0,0 +1,7 @@
+function local_timestamp_to_UTC(tag, timestamp, record)
+    local utcdate   = os.date("!*t", ts)
+    local localdate = os.date("*t", ts)
+    localdate.isdst = false -- this is the trick
+    utc_time_diff = os.difftime(os.time(localdate), os.time(utcdate))
+    return 1, timestamp - utc_time_diff, record
+end
\ No newline at end of file
diff --git a/ansible/roles/logging/defaults/main.yml b/ansible/roles/logging/k3s/defaults/main.yml
similarity index 100%
rename from ansible/roles/logging/defaults/main.yml
rename to ansible/roles/logging/k3s/defaults/main.yml
diff --git a/ansible/roles/logging/tasks/main.yml b/ansible/roles/logging/k3s/tasks/main.yml
similarity index 100%
rename from ansible/roles/logging/tasks/main.yml
rename to ansible/roles/logging/k3s/tasks/main.yml
diff --git a/ansible/roles/logging/templates/elasticsearch.yml b/ansible/roles/logging/k3s/templates/elasticsearch.yml
similarity index 100%
rename from ansible/roles/logging/templates/elasticsearch.yml
rename to ansible/roles/logging/k3s/templates/elasticsearch.yml
diff --git a/ansible/roles/logging/templates/elasticsearch_secret.yml b/ansible/roles/logging/k3s/templates/elasticsearch_secret.yml
similarity index 100%
rename from ansible/roles/logging/templates/elasticsearch_secret.yml
rename to ansible/roles/logging/k3s/templates/elasticsearch_secret.yml
diff --git a/ansible/roles/logging/templates/filebeat.yml b/ansible/roles/logging/k3s/templates/filebeat.yml
similarity index 100%
rename from ansible/roles/logging/templates/filebeat.yml
rename to ansible/roles/logging/k3s/templates/filebeat.yml
diff --git a/ansible/roles/logging/templates/fluentd.yml b/ansible/roles/logging/k3s/templates/fluentd.yml
similarity index 100%
rename from ansible/roles/logging/templates/fluentd.yml
rename to ansible/roles/logging/k3s/templates/fluentd.yml
diff --git a/ansible/roles/logging/templates/kibana.yml b/ansible/roles/logging/k3s/templates/kibana.yml
similarity index 100%
rename from ansible/roles/logging/templates/kibana.yml
rename to ansible/roles/logging/k3s/templates/kibana.yml
diff --git a/ansible/roles/logging/templates/kibana_ingress.yml b/ansible/roles/logging/k3s/templates/kibana_ingress.yml
similarity index 100%
rename from ansible/roles/logging/templates/kibana_ingress.yml
rename to ansible/roles/logging/k3s/templates/kibana_ingress.yml