I have a odd time related issue.
Data is being logged an hour ahead of current time (for Europe/London), and you cannot find it in a search until two hours after the time the event was actually generated!
So as an example…
Event generated: 13:42:54
Timestamp/timestamp on search results: Timestamp 14:42:54, timestamp 14:42:54 +01:00
Unable to find in search results until 15:42:55 local time (Europe/London currently +01:00 from UTC due to daylight savings)
User: 14:52:00 +01:00
Web Browser: 14:52:00 +01:00
Graylog server: 14:52:00 +00:00
The hour difference between the generated event and the Timestamp/timestamp field may be explained by the fact I’m forwarding the events from my previous Graylog server using a Syslog plaintext Output to this new server as I’m testing and ironing out issues.
The thing that concerns me is that the entry cannot be found in a search until two hours after it was logged.
I’m guessing the issue is timezone related, but I’m unclear what to do to resolve it.