# Raw syslog input timezone issue **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 9, 2022, 1:00pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599 "2022-02-09T13:00:55Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![sea\_scaner](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sea\_scaner](https://community.graylog.org/u/sea_scaner)\ **Post date:** [February 9, 2022, 1:00pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/1 "2022-02-09T13:00:55Z")
Hi! I receive raw syslog from network devices. And Graylog in timestamp field shows after time our timezone (+03:00) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/ae5e428760259f7a294d4e1ac14d9af63787a006.png) How can i remove in timestamp field indication +03:00 from all messages? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 9, 2022, 10:47pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/2 "2022-02-09T22:47:03Z")
Hello && welcome @sea_scaner Can I ask why you want to manipulate the Timestamp? As you know after Elasticsearch ingest the message it places the timestamp there. You could creating you own Index Template and/or Pipeline/Extractor to manipulate the Timestamp field. For further suggestion please look here. - [Topics tagged time-stamp-issuespl](https://community.graylog.org/tag/time-stamp-issuespl) ---
**Author:** ![sea\_scaner](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sea\_scaner](https://community.graylog.org/u/sea_scaner)\ **Post date:** [February 10, 2022, 5:00am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/3 "2022-02-10T05:00:38Z")
> [@gsmith](#): > > Timestamp Hi! Thx! The time from my devices comes correct. They all have a time zone of +3.00 I just want to customize the timestap field - so that the time is shown correctly without specifying the timezone. Remove +3.00 for more convenient display in dashboards. ![44444444444](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/cde91b21a661d7106bdc9db038909691133d9f25.png) ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 10, 2022, 5:03am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/4 "2022-02-10T05:03:34Z")
By chance have you considered a pipeline? This might be your best bet. Ill look into it for ya unless someone lese comes around to help ---
**Author:** ![sea\_scaner](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sea\_scaner](https://community.graylog.org/u/sea_scaner)\ **Post date:** [February 10, 2022, 6:06am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/5 "2022-02-10T06:06:47Z")
Thx! In log i recieved logs from device with correct time without timezone: ```auto tail -f /var/lib/graylog-server/journal/messagejournal-0/00000000000000020374.log 89>Feb 10 2022 09:02:04 kzn-akt-ne20e-02 %%01CLI/5/CMDRECORD(s):CID=0x80ca2713;Recorded command information. (Task=VTY0, Ip=10.250.29.138, VpnName=_public_, User=admin, AuthenticationMethod="Tacacs", Command="display clock".) ``` Apparently maybe Graylog or Mongodb add timezone to a timestamp field? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 11, 2022, 1:33am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/6 "2022-02-11T01:33:50Z")
Hello What I believe needs to happen is the TimeStamp field need to be change to your specifications. This can be done via pipeline. You can look here what other community members have done. - [Search results for 'Pipeline\_timestamp' - Graylog Community](https://community.graylog.org/search?q=Pipeline_timestamp) Or here using our Tag system - [Topics tagged time-stamp-issuespl](https://community.graylog.org/tag/time-stamp-issuespl) Depending on your environment this also can be done via extractor. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/11f5b4f18aa4bccad8d4f6a7981a162144acb56e.png) Just an FYI, if this is for a few/couple device need to change the timestamp , perhaps create a new input for them and then add the extractor, it’s all about simplicity for today and tomorrow 🙂 > [@sea\_scaner](#): > > Apparently maybe Graylog or Mongodb add timezone to a timestamp field? This would be mainly be your Elasticsearch. Hope that helps ---
**Author:** ![sea\_scaner](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sea\_scaner](https://community.graylog.org/u/sea_scaner)\ **Post date:** [February 11, 2022, 9:01am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/7 "2022-02-11T09:01:24Z")
Hi thx! I ran several tests. 1. Made an extractor for my RAW UDP input. It ok, but no hits: . ![ext1](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e66428b8e3d01049e6eee9e3fbb8d6d1e97b77b0.png) . 2. I try to Pipeline to change timezone in timestamp field. No errors in Simulator, but no no effect in production: 3. But whet in Pipeline i change timezone to a new field - it ok. I did something wrong somewhere? Is it possible to change the timestamp field without adding a new field? It seems that Greylog automatically adds timezeno to timestamps field. Basically, I’m fine with it, but i want to make it nice ) ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 11, 2022, 10:19pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/8 "2022-02-11T22:19:58Z")
Hello > [@sea\_scaner](#): > > I did something wrong somewhere? > Is it possible to change the timestamp field without adding a new field? Unfortunately you have to make a new field for the timestamp. But here is an idea 😃 So if you created a new timestamp field this will show up on your field search’s. What could be done is remove “timestamp” as shown below. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7bca8972cbf8d0b9a2e9c4679bde8e4de234d181.png) Then add your NEW timestamp field. I don’t have the same fields as you, but I believe you get the point. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3d158e7c03261f5c366a77c3019306709fc353b8.png) Results ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/96a3ae0e82b81d6978e836f3f48816d6aa270613.png) hope that helps EDIT: I just noticed you did the same thing that I posted. ---
**Author:** ![sea\_scaner](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sea\_scaner](https://community.graylog.org/u/sea_scaner)\ **Post date:** [February 14, 2022, 4:52am UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/9 "2022-02-14T04:52:05Z")
> [@gsmith](#): > > hope that helps > > EDIT: I just noticed you did the same thing that I posted. Thx! I will study further 🙂 ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 14, 2022, 11:34pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/10 "2022-02-14T23:34:32Z")
Hello @sea_scaner Another community member was working on a pipeline/timestamp, which I think maybe of interest to you. - [Date Processing - #4 by danmassa7](https://community.graylog.org/t/date-processing/22557/4) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 28, 2022, 11:34pm UTC](https://community.graylog.org/t/raw-syslog-input-timezone-issue/22599/11 "2022-02-28T23:34:35Z")
Closed on February 28, 2022, 11:34pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.