I am experiencing an issue where the raw “timestamp” field stored in Elasticsearch is formatted as below:
“timestamp”:“2022-01-20 16:38:50.438”
As you can see, this timestamp does not include any time zone information. The time zone actually used is UTC. According to ISO 8601/RFC 3339, if no timestamp information is included the time is assumed to be local time.
In the same log entry, Winlogbeat stores the time in a correct ISO 8601 format:
The Z in the entry above indicates that this is the UTC timezone, which is correct.
The fact that Graylog does not include a time zone in its default timestamp while using UTC is causing issues with integration with the Grafana Elasticsearch plugin. Since no timezone information is provided, Grafana assumes the timestamp is local time. You can see other people experiencing the same issue in this thread:
For reference, I am running Graylog 4.1.9, but I don’t think the issue is version specific. Is this behavior something that can be fixed in a patch? Is there a workaround to change the default timestamp until another fix is available?
Thanks for the info. I will try that workaround if I run into a message that only has the default timestamp. I will also investigate whether it makes sense to file this as a bug report.
Thanks for keeping us informed 