Timestamp format when writing to Graylog differs from LogFile and Console

[RHV044]

Hello!

I'm having this trouble and I'm not sure if it is indeed an issue.

Every log I get on Graylog (running on localhost btw) is with UTC 0 format, but logfiles and console have my local timezone (this is what I want actually).

Is this something related to graylog damanding UTC 0? or may be an issue on the sink?

This is my Serilog configuration:

"Serilog": {
   "Using": [ "Serilog.Sinks.Graylog", "Serilog.Sinks.File", "Serilog.Sinks.Console" ],
   "MinimumLevel": {
     "Default": "Debug",
     "Override": {
       "Microsoft": "Warning",
       "System": "Warning"
     }
   },
   "WriteTo": [
     {
       "Name": "Graylog",
       "Args": {
         "MinimumLogEventLevel": "Information",
         "hostnameOrAddress": "127.0.0.1",
         "port": "12201",
         "transportType": "Tcp",
         "restrictedToMinimumLevel": "Information",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     },
     {
       "Name": "File",
       "Args": {
         "restrictedToMinimumLevel": "Information",
         "rollingInterval": 3, //RollingInterval.Day
         "path": "logs/log-.txt",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     },
     {
       "Name": "Console",
       "Args": {
         "restrictedToMinimumLevel": "Information",
         "outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level}] #{ThreadId} {Message:lj}{NewLine}{Properties}{NewLine}{Exception}{NewLine}"
       }
     }

   ],
   "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ],
   "Properties": {
     "Application": "app"
   }
 } 

[whir1]

outputTemplate does not exist in sink

[RHV044]

outputTemplate does not exist in sink

Ok thanks, but that doesn't explain the TimeZone diff

[whir1]

It's because timestamp - "Seconds since UNIX epoch with optional decimal places for milliseconds" it's graylog field. If you want timestamp with TimeZone you should use another field for that.

[Ghostbird]

Note that you can set the user's time zone in the Graylog interface. Graylog shows messages in the configured user time zone (which is UTC by default), regardless of the actual timestamp in the log message. Maybe you got confused by that?