Change timestamp in elastic-agent-json.log ut UTC (#26016) (#26150)

Change encoder to force UTC timestamps in ISO-8601 for the json.log
entries.

(cherry picked from commit c65305b)

Co-authored-by: Michel Laterman <82832767+michel-laterman@users.noreply.github.com>

x-pack/elastic-agent/CHANGELOG.next.asciidoc

@@ -69,6 +69,7 @@
 - Handle case where policy doesn't contain Fleet connection information {pull}25707[25707]
 - Fix fleet-server.yml spec to not overwrite existing keys {pull}25741[25741]
 - Agent sends wrong log level to Endpoint {issue}25583[25583]
+- Change timestamp in elatic-agent-json.log to use UTC {issue}25391[25391]
 
 ==== New features
 

x-pack/elastic-agent/pkg/core/logger/logger.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"time"
 
 	"go.elastic.co/ecszap"
 	"go.uber.org/zap/zapcore"
@@ -23,6 +24,8 @@ import (
 
 const agentName = "elastic-agent"
 
+const iso8601Format = "2006-01-02T15:04:05.000Z0700"
+
 // DefaultLogLevel used in agent and its processes.
 const DefaultLogLevel = logp.InfoLevel
 
@@ -127,6 +130,20 @@ func makeInternalFileOutput(cfg *Config) (zapcore.Core, error) {
 		return nil, errors.New("failed to create internal file rotator")
 	}
 
-	encoder := zapcore.NewJSONEncoder(ecszap.ECSCompatibleEncoderConfig(logp.JSONEncoderConfig()))
+	encoderConfig := ecszap.ECSCompatibleEncoderConfig(logp.JSONEncoderConfig())
+	encoderConfig.EncodeTime = utcTimestampEncode
+	encoder := zapcore.NewJSONEncoder(encoderConfig)
 	return ecszap.WrapCore(zapcore.NewCore(encoder, rotator, cfg.Level.ZapLevel())), nil
 }
+
+// utcTimestampEncode is a zapcore.TimeEncoder that formats time.Time in ISO-8601 in UTC.
+func utcTimestampEncode(t time.Time, enc zapcore.PrimitiveArrayEncoder) {
+	type appendTimeEncoder interface {
+		AppendTimeLayout(time.Time, string)
+	}
+	if enc, ok := enc.(appendTimeEncoder); ok {
+		enc.AppendTimeLayout(t.UTC(), iso8601Format)
+		return
+	}
+	enc.AppendString(t.UTC().Format(iso8601Format))
+}