@jan
“If you try to correct the timestamps of messages that are ingested into Graylog via Syslog - you can’t make that happen by changing the Servers timezone.” - no, the messages comes with correct time stam inside, because there is timezone configuration on the device
As you mentioned somewhere else (Time configuration incorrect) “Graylog internally use UTC and display the time always as UTC not with the local time setting of the server.” - I understand that, but from my experiences from three installations, two of them have Graylog server time adjusted to the local timezone (means no-UTC) and only one installation uses UTC. That’s weird.