# Incorrect time in log **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [August 20, 2018, 12:45pm UTC](https://community.graylog.org/t/incorrect-time-in-log/6510 "2018-08-20T12:45:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 20, 2018, 12:45pm UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/1 "2018-08-20T12:45:11Z")
Hello, Since I updated Graylog I have problems with time. In fact, now I have 2 differents times when I receive logs : ![Capture](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/acacc65780f3e9fd245376d5f46660a106310100.png) I have the same problem on my differents inputs: - Syslog TCP on port 5514, 5513 - Gelf TCP on port 12201 I have note that the time configuration of the server is not the same : ![Capture2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3a725f01b6b691236bc029f5a3c37b07cba9b803.png) Thanks to help me ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 20, 2018, 3:45pm UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/2 "2018-08-20T15:45:15Z")
- from what Version did you update? - what is the server time of the sending server? - does the sending server include timezone information in the timstamp? - what is the timezone of the user you are using? - did you change anything else? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 20, 2018, 3:46pm UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/3 "2018-08-20T15:46:27Z")
Why exactly you opened a new topic and did not just move on in the old? > [@Time configuration incorrect](https://community.graylog.org/t/time-configuration-incorrect/6461/4): > > I guess you did not get it. root\_timezone is the timezone that the user admin - the default superuser - has. His profil is not editable, so you can’t set a timezone outside of the configuration file. Graylog internally use UTC and display the time always as UTC not with the local time setting of the server. ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 21, 2018, 6:50am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/4 "2018-08-21T06:50:01Z")
I don’t have timezone information in the timestamp. I update from 2.4.5 to 2.4.6 ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 21, 2018, 8:50am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/5 "2018-08-21T08:50:04Z")
with no timezone information Graylog assume that the input timezone is UTC. ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 21, 2018, 9:49am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/6 "2018-08-21T09:49:41Z")
> [@jan](#): > > with no timezone information Graylog assume that the input timezone is UTC. So I have to get timezone in the rsyslog configuration of the other server ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 21, 2018, 10:03am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/7 "2018-08-21T10:03:27Z")
that would be the easiest way to solve it at the sender. ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 22, 2018, 8:54am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/8 "2018-08-22T08:54:37Z")
> [@jan](#): > > that would be the easiest way to solve it at the sender. Yes I try to change the format with rsyslog but I have already the same problem. I have try to use different template like that : $template RFC3164fmt,“\<%PRI%\>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%” ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 22, 2018, 11:56am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/9 "2018-08-22T11:56:53Z")
Do you have an idea ? Because it’s not good when I receive log, because the timestamp it’s not good time. Thanks in advance ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 23, 2018, 7:16am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/10 "2018-08-23T07:16:27Z")
Because it’s not possible to configure directly on the Graylog server. Thanks for your help ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 23, 2018, 8:24am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/11 "2018-08-23T08:24:36Z")
you might find this post / pipeline rule helpful to correct the time of message with a pipeline > [@All messages search doesn't seem to include "all messages"](https://community.graylog.org/t/all-messages-search-doesnt-seem-to-include-all-messages/6316/2): > > you would need to correct the timestamp of the messages with extractors or the processing pipelines. I guess the syslog messages did not include timezone information but as written it is possible to correct that. This community board include some posts that had that explained. One example to correct the time with a processing pipeline rule could be: rule "cisco (3.3) correct timestamp NEXUS" // we want to create ISO8601 Timestamps // make '2015 Feb 15 13:33:22.111' ISO8601 when has\_field(… ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 23, 2018, 11:56am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/12 "2018-08-23T11:56:27Z")
Yes but if I doing a rule with pipeline, I think that performances are not very good. ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 31, 2018, 7:49am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/13 "2018-08-31T07:49:00Z")
Do you have an example for change date with pipeline ? Thanks in advance ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [August 31, 2018, 8:15am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/14 "2018-08-31T08:15:26Z")
in the linked post is one rule that does that. ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 31, 2018, 8:37am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/15 "2018-08-31T08:37:44Z")
thanks but it doesn’t works ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [August 31, 2018, 12:43pm UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/16 "2018-08-31T12:43:57Z")
I have create this pipeline ``` rule "timestamp_now+2" when true then let new_date = parse_date( to_string($message.timestamp),"yyyy-MM-dd HH:mm:ss.SSS","Europe/Paris"); set_field("timestamp", new_date); end ``` And I’ve this error message from input : `For rule 'timestamp_now+2': In call to function 'parse_date' at 5:15 an exception was thrown: Invalid format: "2018-08-31T14:42:07.000+02:00" is malformed at "T14:42:07.000+02:00"` Do you have an idea ? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [September 1, 2018, 7:37am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/17 "2018-09-01T07:37:19Z")
you give the rule the information that your timestamp is looking: `yyyy-MM-dd HH:mm:ss.SSS` but it is actually `yyyy-MM-ddTHH:mm:ss.SSSX`(should work this way) ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [September 1, 2018, 11:52am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/18 "2018-09-01T11:52:41Z")
Thanks for information. I try to use this ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [September 3, 2018, 6:41am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/19 "2018-09-03T06:41:22Z")
When I try with your solution it’s doesn’t works. In fact I have this message in my logs : `For rule 'timestamp_now+2': In call to function 'parse_date' at 5:15 an exception was thrown: Illegal pattern component: T` When I delete the T I have this error message: `For rule 'timestamp_now+2': In call to function 'parse_date' at 5:15 an exception was thrown: Illegal pattern component: X` I try to use this pipeline : ``` rule "timestamp_now+2" when true then let new_date = parse_date( to_string($message.timestamp)," yyyy-MM-dTHH:mm:ss.SSSX","Europe/Paris"); set_field("timestamp", new_date); end ``` Do you have an idea ? ---
**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\ **Post date:** [September 4, 2018, 6:44am UTC](https://community.graylog.org/t/incorrect-time-in-log/6510/20 "2018-09-04T06:44:07Z")
I try to use an other element that I see on the forum : `let new_timestamp = parse_date(to_string($message.log_timestamp), “yyyy-MM-dd HH:mm:ss,SSS”, “AU”, “Australia/Perth”);` But It’s doesn’t works, I have a problem with this : `For rule 'timestamp_now+2': In call to function 'parse_date' at 5:20 an exception was thrown: Invalid format: ""` Do you have an idea ? Thanks in advance [Next page](https://community.graylog.org/t/incorrect-time-in-log/6510.md?page=2)