# 6 Hour delay in pipeline drop

**URL:** <https://community.graylog.org/t/6-hour-delay-in-pipeline-drop/35927>\
**Category:** Graylog Central (peer support)\
**Created:** [July 2, 2025, 6:20am UTC](https://community.graylog.org/t/6-hour-delay-in-pipeline-drop/35927 "2025-07-02T06:20:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![trendal](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/trendal/32/734_2.png) [@trendal](https://community.graylog.org/u/trendal)\
**Post date:** [July 2, 2025, 6:20am UTC](https://community.graylog.org/t/6-hour-delay-in-pipeline-drop/35927/1 "2025-07-02T06:20:08Z")

</div>

I can’t seem to find what version we’re running in webUI, but it was updated in the last couple months to whatever was current at that time.

Last night I was trying to drop some really spammy useless messages and the pipeline rule was not working, or so it seemed. The counters were going up, but the messages were still in the Default Stream. Today looking back, it appears the filter applied a full 6 hours after I configured it.

Is this common? The red line was where I configured the pipeline. The target messages continued to be received for another 6 hours.

 ![image843](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/6/b/6baf65dfebb7afc709cbc97348684afc1ced2f88.png)

---

<div class="post-metadata">

**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\
**Post date:** [July 2, 2025, 12:00pm UTC](https://community.graylog.org/t/6-hour-delay-in-pipeline-drop/35927/2 "2025-07-02T12:00:54Z")

</div>

I guess you have some kind of time offset with your timestamps. Did you ever try to create a unique log, and then searched it in your logging? how much offset did that have?

Can you try to run a search from yesterday until tomorrow via the timeselector and then have a look, if you have more logs “from the future”?

Graylog saves the UTC timestamp to all logs, and changes the field “timestamp” to the time you configured in the options of you user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 16, 2025, 2:17pm UTC](https://community.graylog.org/t/6-hour-delay-in-pipeline-drop/35927/3 "2025-07-16T14:17:56Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.