# @timestamp error on syslog logs

**URL:** <https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487>\
**Category:** Logstash\
**Created:** [January 29, 2016, 2:19pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487 "2016-01-29T14:19:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zokratez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zokratez/32/5974_2.png) [@zokratez](https://discuss.elastic.co/u/zokratez)\
**Post date:** [January 29, 2016, 2:19pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/1 "2016-01-29T14:19:42Z")

</div>

I'm monitoring different logs such Squid, Apache, Nginx, Secure and Message syslogs, Postfix and Dovecot.

When the Squid, Apache and Nginx logs arrive the @timestamp time is the same of my PC and Servers times. Otherwise, when syslogs, postfix and Dovecot arrives, the @timestamp have 2 hours diff and in the graphic appear as "future logs".

I search in the forum but not found nothing similar...

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![ben.joyce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben.joyce/32/7393_2.png) [@ben.joyce](https://discuss.elastic.co/u/ben.joyce)\
**Post date:** [January 29, 2016, 6:23pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/2 "2016-01-29T18:23:08Z")

</div>

Do you want to override the @timestamp with the timestamp from the log,  
rather than the system time the log was imported?

---

<div class="post-metadata">

**Author:** ![zokratez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zokratez/32/5974_2.png) [@zokratez](https://discuss.elastic.co/u/zokratez)\
**Post date:** [January 29, 2016, 6:31pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/3 "2016-01-29T18:31:15Z")

</div>

No, I want @timestamp to have the real system time... Now is adding 2 hours to the system time, but only on these logs... in Apache @timestamp have the correct system time.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [January 29, 2016, 10:42pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/4 "2016-01-29T22:42:18Z")

</div>

Can you post your config? We'll need to see it to assess further.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 30, 2016, 3:02pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/5 "2016-01-30T15:02:22Z")

</div>

What's the timezone for the servers involved?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487/6 "2017-07-06T05:13:41Z")

</div>

Closed on July 6, 2017, 5:13am UTC