# Still having timestamp issues

**URL:** <https://community.graylog.org/t/still-having-timestamp-issues/11028>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [July 3, 2019, 8:22am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028 "2019-07-03T08:22:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tuumke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tuumke/32/2549_2.png) [@Tuumke](https://community.graylog.org/u/Tuumke)\
**Post date:** [July 3, 2019, 8:23am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028/1 "2019-07-03T08:23:00Z")

</div>

I still have issues with timestamps. I don’t understand why it gives me +2. I just want the original timestamp to show and the system should not modify anything.  
I have created a (working) pipeline because of previous topic i created. This is the result.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5bf12a4ceb087ab465a0d66b0b719c001705d87a.png)

But i still see:  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3aa741e2aae85ab4e56205f287fcef63e19c9f7c.png)

Why would the system show me my timezone timestamp? That is so not logical…  
I want to see the timestamp of the message. Not the timestamp of the message modified to my current timezone.  
Rule on my pipeline:

```
rule "fortigate timestamp"
when
has_field("devname") && has_field("date") && has_field("time")
then
let build_message_0 = concat(to_string($message.date), " ");
let build_message_1 = concat(build_message_0, to_string($message.time));
let new_timestamp = parse_date(value:to_string(build_message_1), pattern:"yyyy-MM-dd HH:mm:sss", timezone:"Europ/Amstedam");
set_field("timestamp", new_timestamp);
set_field("Timestamp", new_timestamp);
set_field("test_timestamp", new_timestamp);
End

```

Maybe i need to wait for 2 hours for it to catch up but changing to absolute time and going 2 hours or more in the future still shows wrong messages.  
According to my old topic, this should have been fixed in 3.0

> [@Fortigate graylog modifies timestamp?](https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757/17):
>
> you might notice that this is a DISPLAY fix. The timezone of the messages is correct always - the full time. Taking your picture from [Fortigate graylog modifies timestamp?](https://community.graylog.org/t/fortigate-graylog-modifies-timestamp/5757/7) The first timestamp is translated to the Users local timezone (set in the profile for normal user) which is for the root user whatever is written to the configuration. The second field just displays the time as it is saved in the Elasticsearch. Which is UTC. That will be fixed in 3.0, the display of the timestamps will be u…

But im on Graylog 3.0.2+1686930  
-edit-  
Since the devices in question are already in TZ Europe/Amsterdam, should i change the new timestamp to UTC first? And then i get correct timestamps?.. thats not logical either but…

---

<div class="post-metadata">

**Author:** ![Tuumke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tuumke/32/2549_2.png) [@Tuumke](https://community.graylog.org/u/Tuumke)\
**Post date:** [July 3, 2019, 9:39am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028/2 "2019-07-03T09:39:20Z")

</div>

Have been trying with a new rule to use the eventtime field (epoch time). It does convert it but i cant change the timestamp field.

```
rule "Epoch Convert"
when
has_field("devname") && has_field("date") && has_field("time") && has_field("eventtime")
then
let epoch = parse_date("1970-01-01T00:00:00.000Z", "yyyy-MM-dd'T'HH:mm:ss.SSSZ");
let ts_seconds = seconds(to_long($message.eventtime));
set_field("epoch_timestamp", epoch + ts_seconds);
set_field("timestamp", epoch + ts_seconds);
End

```

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b02520a2e17c571bfd5835a876e55d98f6ba62e7.png)

---

<div class="post-metadata">

**Author:** ![Tuumke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tuumke/32/2549_2.png) [@Tuumke](https://community.graylog.org/u/Tuumke)\
**Post date:** [July 3, 2019, 10:50am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028/3 "2019-07-03T10:50:13Z")

</div>

I think this is my solution (created new Indice to put the messages in). Also read somehwere that using RAW TCP input might help, that wasn’t the case. Using SYSTLOG TCP port 30000.

1. Created a stream for my fortigates (SYSLOG TCP 30000)
2. Created a pipeline for this stream
3. Set “Continue processing on next stage when” to any
4. Use the rule Epoch Convert  
rule “Epoch Convert”  
when  
has\_field(“devname”) && has\_field(“date”) && has\_field(“time”) && has\_field(“eventtime”)  
then  
let epoch = parse\_date(“1970-01-01 00:00:00.000Z”, “yyyy-MM-dd’ 'HH:mm:ss.SSSZ”);  
let ts\_seconds = seconds(to\_long($message.eventtime));  
set\_field(“epoch\_timestamp”, epoch + ts\_seconds);  
set\_field(“timestamp”, epoch + ts\_seconds);  
End

Now my messages show up correct for my timezonze. FortiGates are configured for Europe/Amsterdam, so is my timezone:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/73ea492554f8211e605831a7d727e2997b2d212c.png)

---

<div class="post-metadata">

**Author:** ![lindonm](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@lindonm](https://community.graylog.org/u/lindonm)\
**Post date:** [July 4, 2019, 2:41am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028/4 "2019-07-04T02:41:22Z")

</div>

You should always store the timestamps as UTC, for all of your systems regardless of the local timezone - This gives you consistent data.

The console will then show you the timestamp in your local zone, based on your profile preferences - Click on your name, then **Edit Profile** then edit your timezone.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e7b08ce2db7b9b10f97eadb133225521f61d1e54.png)

What you can see from mine is the @timestamp (which is what is actually written to the index) is UTC - But the “timestamp” column is calculated, based on my local timezone (+10) - If i wanted to see/search on that in +2, UTC or any other timezone, I just need to edit my profile.

That way, when you search for “what happened in the last 8 hours globally”, you will see results from all your devices based on the true last 8 hours, regardless of what timezone they are in.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 18, 2019, 2:41am UTC](https://community.graylog.org/t/still-having-timestamp-issues/11028/5 "2019-07-18T02:41:24Z")

</div>

Closed on July 18, 2019, 2:41am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.