The messages from your FortiGate devices don’t contain a timezone information, so Graylog assumes they’re UTC.
For example the second message includes date=2017-11-21 time=13:13:20, which Graylog assumes is 2017-11-21T13:13:20Z. Then Graylog displays the message timestamp in your configured timezone (+5:30), which is 2017-11-21T18:43:20.000.
If you want to modify the date of the messages, you can do so in a pipeline rule:
http://docs.graylog.org/en/2.3/pages/pipelines.html
Also check out the following related feature request: