you might notice that this is a DISPLAY fix. The timezone of the messages is correct always - the full time.
Taking your picture from Fortigate graylog modifies timestamp?
The first timestamp is translated to the Users local timezone (set in the profile for normal user) which is for the root user whatever is written to the configuration. The second field just displays the time as it is saved in the Elasticsearch. Which is UTC.
That will be fixed in 3.0, the display of the timestamps will be unified.