# Time of the log is 10 hours ahead in Kibana

**URL:** https://discuss.elastic.co/t/time-of-the-log-is-10-hours-ahead-in-kibana/234464
**Category:** Logstash
**Created:** [May 27, 2020, 6:20am UTC](https://discuss.elastic.co/t/time-of-the-log-is-10-hours-ahead-in-kibana/234464 "2020-05-27T06:20:02Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![shadid](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@shadid](https://discuss.elastic.co/u/shadid)
#### Post date: [May 27, 2020, 6:20am UTC](https://discuss.elastic.co/t/time-of-the-log-is-10-hours-ahead-in-kibana/234464/1 "2020-05-27T06:20:02Z")

</div>

Hi,

I have created a logstash filter to parse palo alto syslog. Below is the configuration.

```auto
filter {
  if [fields][node_type] == "firewall" {
    if [message] =~ /-- MARK --/ { drop {}}
    if [message] =~ /last message repeated/ { drop {}}

    grok {
      match => { "message" => "^(%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:syslog_timestamp}|)%{DATA:syslog_message}$"}
      tag_on_failure => ["_syslog_timestamp_grokparsefailure"]
    }
    grok {
      match => { "syslog_message" => "^\s*%{HOSTNAME:syslog_source}(:|)\s+%{DATA:syslog_message}$"}
      overwrite => ["syslog_message"]
      tag_on_failure => ["_syslog_source_grokparsefailure"]
    }
    if [syslog_message] =~ /1,\d+\/\d+\/\d+ \d+:\d+:\d+,\d+,\w+/ {
      mutate {
        rename => { "syslog_message" => "palo_message" }
      }
    }
  }
}

filter {
  if [palo_message] {
    mutate {
      add_tag => "palo_firewall"
      replace => { "type" => "firewall-palo" }
      gsub => [
         "palo_message", ",,", ",0,"
     ]
    }
   }
    grok {
     match => { "palo_message" => "1,(?<event.receive>\d+\/\d+\/\d+ \d+:\d+:\d+),(?<device.serial>\d+),(?<event.type>\w+),(?<event.subtype>[\w.-]+),\d+,(?<event.created>\d+\/\d+\/\d+ \d+:\d+:\d+),(?<device.vsys>\w+),(?<event.eventID>[\w.-]+),(?<event.object>[\w.-]+),\d+,\d+,(?<event.module>\w+),(?<event.severity>\w+),(?<event.description>(\".*\")|-),(?<event.seqno>\w+),(?<event.action_flag>\w+),(?<event.devH_g1>\d+),(?<event.devH_g2>\d+),(?<event.devH_g3>\d+),(?<event.devH_g4>\d+),(?<event.vsys_name>\w+),(?<event.device_name>[\w.-]+)"}
     tag_on_failure => ["_palo_event_module_grokparsefailure"]

    }

    date {
        timezone => "UTC"
        match => ["event.created", "yyyy/MM/dd HH:mm:ss.SSSZ"]
      }
}

```

in kibana, the event.created is showing time time 10 hours ahead

 ![Capture-kibana](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d86b52546382af52f49178eacec9fa93d51b443c.png)

would really appreciate any help

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 24, 2020, 6:20am UTC](https://discuss.elastic.co/t/time-of-the-log-is-10-hours-ahead-in-kibana/234464/2 "2020-06-24T06:20:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.