I'm using Graylog 2.03 and I'm having some issues with the one hour time difference introduced by daylight saving time. We have 1000's of devices syslog'ing to our Graylog server. Even though these devices have the correct timezone configured (PST), they don't auto-adjust for daylight saving time... which means that the time stamp for each message on the Graylog server is off (behind) by one hour. I could manually adjust the time zone to a zone that is one hour ahead, but given the number of devices we have, this is not feasible (and plain dumb). Since I also have devices with the correct time logging to the same Graylog server, changing the time on the server is not solving the problem either. I need to have the time stamps adjusted to reflect the correct time, so that my stream condition rules can work correctly. What is the best way to handle this? Is a extractor converter what I'm looking for?
Thanks for the help JB -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/19d60968-7dc2-46c9-b119-3fc48a408634%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
