# Timestamp issue/question

**URL:** <https://community.graylog.org/t/timestamp-issue-question/13979>\
**Category:** Graylog Central (peer support)\
**Created:** [February 14, 2020, 7:12pm UTC](https://community.graylog.org/t/timestamp-issue-question/13979 "2020-02-14T19:12:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan](https://avatars.discourse-cdn.com/v4/letter/d/eada6e/32.png) [@dan](https://community.graylog.org/u/dan)\
**Post date:** [February 14, 2020, 7:12pm UTC](https://community.graylog.org/t/timestamp-issue-question/13979/1 "2020-02-14T19:12:06Z")

</div>

I have the same issue as described in this post:

> [@Timestamp Issue - Different Timestamps](https://community.graylog.org/t/timestamp-issue-different-timestamps/8041):
>
> Hi all, We have a Fortinet firewall sending logs to a Graylog server. There was an issue with the timestamps being off, so we followed the advice of this post to create a pipeline to set the desired time zone. The pipeline seems to work and the timestamp field is set correctly. However, in the Search page when you see the messages from the firewall in the search results box there is the Timestamp field on the far left that shows the current time minus 8 hours. If you mouse over the Timestamp…

In System/Overview, all 3 times are the same and correct.  
My concern is that when I do a search for any new (in the last 5 minutes), nothing shows up because of this time discrepancy. I have to change it for “in the last 8 hours” in order to see any data.

I do not understand the above linked post’s comments, so I don’t know if a fix was mentioned (timestamp conversion) or not.

---

<div class="post-metadata">

**Author:** ![ADeeeee](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/adeeeee/32/6593_2.png) [@ADeeeee](https://community.graylog.org/u/ADeeeee)\
**Post date:** [February 15, 2020, 4:01am UTC](https://community.graylog.org/t/timestamp-issue-question/13979/2 "2020-02-15T04:01:30Z")

</div>

I am not sure if I have the same issue:

> Graylog 3.0.2+1686930, codename _Space Moose_  
> Host OS: Ubuntu 18.04.3 LTS  
> Host: 2020-02-15 11:52:05 +08:00
> 
> ## Time configuration
> 
> > User \*\*\*\*\*\*: 2020-02-15 11:52:05 +08:00  
> > Your web browser: 2020-02-15 11:52:05 +08:00  
> > Graylog server: 2020-02-15 11:52:29 +08:00
> 
> root\_timezone = UTC

The syslog with timestamp with UTC got transformed to UTC-8 as raw data. It’s doing well if your syslog timestamp is in UTC+8, which is not the standard as we wish.

How do I stop the transformation for particular syslog if there’s still other raw data need to be transformed?

update: the timestamp is minus 8 hours behind and only the full\_message shows the correct one.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 17, 2020, 12:43pm UTC](https://community.graylog.org/t/timestamp-issue-question/13979/3 "2020-02-17T12:43:49Z")

</div>

the question is:

- does that timestamp include a timezone?

If the timestamp did not include timezone information, Graylog works with that timestamp as it is UTC.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 2, 2020, 12:43pm UTC](https://community.graylog.org/t/timestamp-issue-question/13979/4 "2020-03-02T12:43:53Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.