Hi Ronald, Graylog currently doesn't log the ingestion time of messages explicitly. The implicit behavior is to use the ingestion time as message timestamp if the "timestamp" field in GELF messages is missing (in tune with the GELF specification).
Other than that I can only recommend to run an NTP daemon on your client systems to keep time in sync (or use other means to achieve that goal). Cheers, Jochen On Tuesday, 29 March 2016 11:11:28 UTC+2, Ronald Brindl wrote: > > We recently had the problem that some of our machines were running with a > system time several days in the future. > Since the log's timestamps are used when indexing in graylog, those log > entries only showed up when selecting a future timeframe, not when they > really were logged. > > Is it somehow possible to override the default of using the timestamp from > the log and instead generate a timestamp when the logs are received? > > We are using logback 1.3.4 and are either using rsyslogd on ubuntu for > system level logging or the Moocar gelf library for logback for java > applications: > https://marketplace.graylog.org/addons/a57457e4-dc2a-487e-aa75-6f1a1c1b3806 > > Regards, > Ron. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/1f7ce68c-9cb6-4d81-be00-4081445acfe5%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
