i am having some problems with the Event Feature.
My System is running in UTC+2 which is working correctly. The Messages are showing in search with the correct time, everything perfect.
But when i try to run an event it isnt showing the correct time there.
Example:
Message coming in “Timestamp: 11:00”
Displayed in Search correcty
Under “Edit Event Definition” it is showing with “Timestamp: 9:00”.
How can i change it?
Info:
Sometimes the Event is showing the correct timestamp, idk why it is working only sometimes
Graylog is running internal with UTC and all operation is done UTC and all time is saved in UTC. Only for the user that is calculated to the set time in the user profile.
When a time on ingest does not include any timezone information Graylog assume that this timestamp is UTC - maybe that is the problem?
