When the syslog host doesn't use UTC for its timezone then a conversion is needed. The system module has an option for this called convert_timezone.
You need to delete the existing pipeline for the change to take effect. See: Filebeat 6.2.1 system module does not convert timestamp with timezone