We are looking to rotate indices every 7Days in a particular time and our timezone is EST but Graylog is rotating midnight UTC. How can we specify a particular time to start rotation instead of midnight? We tried following ISO8601 information but its not accepting that rule.
Any help is appreciated.
It is not possible. Graylog is using UTC Internal and if you run something on daily rotation it will use UTC time to run. So what you see is intentional.
You can search for a feature request to be able to change that - and if you do not find one, create a new feature request over at Github that the time for the index rotation should be configurable: