# Fortigate graylog modifies timestamp?

**URL:** <https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757>\
**Category:** Graylog Central (peer support)\
**Created:** [June 27, 2018, 11:31am UTC](https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757 "2018-06-27T11:31:09Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Tuumke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tuumke/32/2549_2.png) [@Tuumke](https://community.graylog.org/u/Tuumke)\
**Post date:** [June 28, 2018, 9:37am UTC](https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757/7 "2018-06-28T09:37:08Z")

</div>

Timestamp is still +2 and timestamp in the logmessage still has Z behind it.  
 ![afbeelding](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/cf1383b533d2fab57f69108a5bea913179d7ca97.png)

Using this now:  
rule “fortigate timestamp”  
when  
has\_field(“devname”) && has\_field(“date”) && has\_field(“time”)  
then  
let build\_message\_0 = concat(to\_string($message.date), " ");  
let build\_message\_1 = concat(build\_message\_0, to\_string($message.time));  
let new\_timestamp = parse\_date(value:to\_string(build\_message\_1), pattern:“yyyy-MM-dd HH:mm:sss”, timezone:“Europ/Amstedam”);  
set\_field(“timestamp”, new\_timestamp);  
end  
In which logfiles should i look?

---

_[View the full topic](https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757)._