# Graylog - Sidecar question

**URL:** <https://community.graylog.org/t/graylog-sidecar-question/21199>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar\
**Created:** [September 15, 2021, 1:55pm UTC](https://community.graylog.org/t/graylog-sidecar-question/21199 "2021-09-15T13:55:57Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 18, 2021, 12:16am UTC](https://community.graylog.org/t/graylog-sidecar-question/21199/8 "2021-09-18T00:16:06Z")

</div>

> [@Oirbsiu](#):
>
> is this a bug?

Not that I Know of. Elasticsearch stores all “time” fields in UTC/Epoch. I would double check your times/Date on each device and to make sure there not a problem.

```auto
TimeStamp 2021-09-17 08:27;05.496
@timestamp 2021-09-17T07:27:04.088Z
Event_Timestamp 2021/09/17/ 08:26:54

```

You have something crazy going on, not sure what.

Maybe some of these post will help

> [@Diferent Timestamp Webpage and server](https://community.graylog.org/t/diferent-timestamp-webpage-and-server/13511/2):
>
> Graylog saves all dates in UTC format, and shows it in GUI in timezone configured for particular user. For user admin, it uses timezone defined in /etc/graylog/server/server.conf file, parameter root\_timezone. root\_timezone = Europe/Bratislava Change Europe/Bratislava to your real timezone, and restart graylog server. [https://docs.graylog.org/en/3.1/pages/configuration/server.conf.html#general](https://docs.graylog.org/en/3.1/pages/configuration/server.conf.html#general) For other user accounts other than admin, configuration is done in GUI. Every user can change t…

[https://community.graylog.org/search?q=Timestamp](https://community.graylog.org/search?q=Timestamp)

> **[Filebeat incorrect timestamp](https://discuss.elastic.co/t/filebeat-incorrect-timestamp/189009/3)**
>
> Thanks for the answer, the raw logs received in to ES were in my local timezone, but ES what I think was happening was ES assumed they were UTC and added +2 hours when storing them which meant I could not see any data unless I moved the time scale...

> <https://github.com/Graylog2/collector-sidecar/issues/231>
>
> \### Problem description
> When logs are sent to graylog, they are not sorted acco…rding to time, but have errors.
> \### Steps to reproduce the problem
> 
> 1. look
> !\[graylog\_time\](https://user-images.githubusercontent.com/6148257/38787874-36c80b44-4163-11e8-91fa-174e90b57f44.png)
> 
> 
> who can help me,thanks very mach!!!
> \### Environment
> 
> \* Sidecar Version:collector-sidecar-0.1.4-1.x86\_64
> \* Graylog Version:Graylog 2.4.3+2c41897 
> \* Operating System:Centos7
> \* Elasticsearch Version:elasticsearch-5.6.3
> \* MongoDB Version:

**EDIT** : I read over this post trying to figure out an awswer for you about the hour difference.  
Just realize something. If Elasticsearch stores all “time” fields in UTC/Epoch ‎and UTC · ‎Greenwich Mean Time (GMT) . Then your statement was

> [@Oirbsiu](#):
>
> I use isle\_of\_man which is basically London BST (GMT+1)

There is your hour difference. I’m not 100% sure but a pipeline might be in your future to set these timestamps correct.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7b81b258069f32a0eaae91ff8da81b169adb7cfa.png)

---

_[View the full topic](https://community.graylog.org/t/graylog-sidecar-question/21199)._