Graylog - Sidecar question

[gsmith]

@Oirbsiu

is this a bug?

Not that I Know of. Elasticsearch stores all “time” fields in UTC/Epoch. I would double check your times/Date on each device and to make sure there not a problem.

TimeStamp 2021-09-17 08:27;05.496
@timestamp 2021-09-17T07:27:04.088Z
Event_Timestamp 2021/09/17/ 08:26:54

You have something crazy going on, not sure what.

Maybe some of these post will help

Diferent Timestamp Webpage and server

Graylog saves all dates in UTC format, and shows it in GUI in timezone configured for particular user. For user admin, it uses timezone defined in /etc/graylog/server/server.conf file, parameter root_timezone. root_timezone = Europe/Bratislava Change Europe/Bratislava to your real timezone, and restart graylog server. https://docs.graylog.org/en/3.1/pages/configuration/server.conf.html#general For other user accounts other than admin, configuration is done in GUI. Every user can change t…

https://community.graylog.org/search?q=Timestamp

Filebeat incorrect timestamp

Log collection time error

EDIT: I read over this post trying to figure out an awswer for you about the hour difference.
Just realize something. If Elasticsearch stores all “time” fields in UTC/Epoch ‎and UTC · ‎Greenwich Mean Time (GMT) . Then your statement was

@Oirbsiu

I use isle_of_man which is basically London BST (GMT+1)

There is your hour difference. I’m not 100% sure but a pipeline might be in your future to set these timestamps correct.