What's the timezone for the original timestamp in the message field? Right now it includes no timezone information so Elasticsearch will assume it is in UTC. When Kibana gets the date in UTC it adds two hours to account for your local timezone. If you want message, data, and time to all match you'll need to add the timezone to the message field before indexing your documents into elasticsearch.