Feature request — server-side timezone formatting for ts in query results

Feature Requests
1

Greetings LC team,

Running LimaCharlie as an MSSP with all customers in Africa/Nairobi (EAT, UTC+3). API and CLI query results return the ts field as a UTC-formatted string (e.g. ts: '2026-08-03 06:08:14'), which is correct but forces every downstream report generator to convert to local time — and to distinguish ts from source-emitted timestamps in event/* fields that may already be in the source device’s TZ (Fortigate, Untangle, Pfsense, Sophos, CheckPoint CEF, syslog, etc.).

Two questions:

  1. Is there an existing (undocumented) knob — org config, query param, CLI flag — that formats ts in a specified timezone at the server side? I probed ui/timezone, timezone, display_timezone via limacharlie org config-get and all came back unknown.

  2. If not, would you consider adding either:

    • A --timezone <IANA> flag on limacharlie search run (and the equivalent API param), that formats ts in the returned rows to that TZ, or
    • An org-level default display timezone stored alongside the org config, applied server-side to ts in query responses.

Rationale: every MSSP outside UTC hits this, and every consumer of search currently duplicates the same conversion logic. A single server-side option would remove that burden. Web UI time-zone is already per-user (Profile → User Preferences), so this would just close the loop for CLI/API consumers. It is hectic to correlate detections timestamps and events with mismatch on time-zones.

Happy to test a beta if you’re inclined.