Default “timestamp” field does not contain time zone information

Graylog is storing the raw “timestamp” field in Elasticsearch as formatted below:

“timestamp”:“2022-01-20 16:38:50.438”

As you can see, this timestamp does not include any time zone information. The time zone actually used is UTC. According to ISO 8601/RFC 3339, if no time zone information is included the time is assumed to be local time.

https://en.wikipedia.org/wiki/ISO_8601#Time_zone_designators

In the same log entry, Winlogbeat stores the time in a correct ISO 8601 format:

“winlogbeat_@timestamp”:“2022-01-20T16:38:50.438Z”

The Z in the entry above indicates that this is the UTC timezone, which is correct.

The fact that Graylog does not include a time zone in its default timestamp while using UTC is causing issues with integration with the Grafana Elasticsearch plugin. Since no timezone information is provided, Grafana assumes the timestamp is local time. You can see other people experiencing the same issue in this thread:

https://github.com/grafana/grafana/issues/21890

For reference, I am running Graylog 4.1.9, but I don’t think the issue is version specific.