Time zone delay

Graylog Central (peer support)
2

Well, there are a few ways to solve this.

  1. Ensure all your servers timezones are set to UTC (even if they don’t live in UTC), then all your timestamps arrive in UTC.
  2. Alternatively hook up a pipeline or two, parse the log dates (flex_date_parse is great), and ensure you convert to UTC, then replace the original timestamp field with the new timestamp in UTC.
  3. There is no 3.

Also make sure that in your user profile you have set your timezone properly because it does take that into account.

1 Like