Mayby graylog interpret ECST as Ecuador Summer Time, which is UTC-5. If you add your UTC+2 timezone is -7 hour difference.
So you probably wrongly configured your cisco devices? Instead of CEST you used wrong name ECST by mistake?
Correct setting for CEST (UTC+2) for cisco IOS:
clock timezone CET +1 0
clock summer-time CEST recurring last Sun Mar 02:00 last Sun Oct 03:00
Correct setting for CEST (UTC+2) for cisco nexus:
clock timezone CET 1 0
clock summer-time CEST 5 Sun Mar 02:00 5 Sun Oct 03:00 60