You have a timezone issue is my guess. Compare that time in the actual message to the time on the left when you expand the message, they will be off by 4 hours probably. Check this blog post to see if anything helps https://graylog.org/post/time-zones-a-loggers-worst-nightmare/