Epoch in _timestamp is wrong

[meppss]

Which OpenObserve functionalities are the source of the bug?

log search, ingestion

Is this a regression?

Yes

Description

I noticed then when searching logs, the builtin timestamp key is used. It uses the epoch format, converted into human readable based on the timezone selected.

What I've noticed is the epoch time is incorrect as when converted it displays a time that is 5 hours prior. I'd like to know if there is something I should be configuring differently or if this is truly a bug. Appreciate any help you can provide.

I am using syslog for ingestion and using a docker deployment.

Please provide a link to a minimal reproduction of the bug

No response

Please provide the exception or error you saw

No response

Please provide the version you discovered this bug in (check about page for version information)

Version: v0.7.0-rc2
Commit Hash: 012df708b197d7e93b2fa539e494524640f7d17b
Build Date: 2023-11-08T15:44:03Z
OS: Docker

Anything else?

No response

[prabhatsharma]

If you are passing the _timestamp field yourself then it must be in UTC timezone. Otherwise, OpenObserve will handle it correctly. Most likely you are passing the _timestamp field during ingestion which is 5 hours earlier or timezone has not been set in your case.