Timestamp 1 Hour Off

Good afternoon, my guess is this was caused by the time change, but I don’t know why.

The Timestamp in Search says:

But the Time configuration under System/Overview says:

I checked the time on sources and they report the correct time.

I checked the time on the OS where Graylog runs (1 server setup) and it reports the correct time.

What am I missing? Thank you, Zach.

Could it be from daylight savings time (DST)?

I think it is for sure from the time change. But I can’t find anything that is an hour off other than the Search view in the UI. Thank you, Zach.

Had the same problem.
One node was set for different time zone (hour off) and the other node didnt update time for DST.

This is 1 node install. Graylog, Elasticsearch, mongodb all on 1.


At the end there it’s -5:00 hours. It should be -4:00 hours and it is every where I have been able to check.

Where would it be getting that? Thank you, Zach.

It would appear to be this setting in server.conf

root_timezone = America/Detroit

I have also tried EST

But those are both -05:00 What should be here?

I ended up using Etc/GMT+4


Yes, you are correct, by chance did you restart your graylog service when you modified you server configuration file?

Mine is America/Chicago


I had to install ntp service on my graylog server while back.

1 Like

I ended up having to change the time zone to Etc/GMT+4 and rebooting the server. A restart of the service did not seem to kick it over. I’m going to leave it for now and maybe play around with it later. Thank you, Zach.

1 Like

I just installed Graylog and have the same issue. My timezone is America/Asuncion. I solved this changing the timezone of my server. In this case is an Ubuntu 18.04 LTS. The command was: timedatectl set-timezone America/Asuncion

Also, in the server.conf of Graylog i put root_timezone = America/Asuncion

Hope this helps to anyone.


i don´t know if the command is the same in ubuntu, but can you check
timedatectl ?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.