Messages 2 hours behind


We are using Graylog 3.2.4 and in the GUI messages are shown 2 hours later


1 TCP input is created and messages are coming in coming from our firewall on port 5514

the system times show all 3 correctly in the GUI and also the firewall uses the same time.


what can we do to have real time messaging ? doesn’t have to be the same second but would be nice to see it much quicker.

one of the fields in the message shows:

so it looks like it has time zone information. We are using UTC + 2 so looks correct. ( Amsterdam )

the timestamp in one of the messages itself looks like this:


2020-08-28 16:37:01 +02:00

thanks for your information. Is is a nice puzzle to solve anyway :grinning:. We very much like the graylog application so I think this is easy to correct. If it needs a pipeline can you provide us with an example ? Not sure if this is the case.


Are you having the same issue currently being discussed in this thread?

Yes this looks exactly the same issue. I will keep on following this post. Thanks for pointing this out.


when I do a search 2 hours later ( the time now being 9:54) and do a absolute search for 11:54 the message is showing in the GUI


Check my previous post, it should help you:

Thanks… it now works I have setup the rule and the pipeline. Very NIce !!! :star_struck:

I had to wait a little bit… after making the change I did not immediately worked. I checked 2 hours later and now the messages are coming in real time with the correct time stamp

kind regards


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.