SOC timestamp different from ElasticSearch

[i-and-me]

Hi all,

Recently I added a fortinet module from filebeat. Works good, but The timezone wasn't correct, so I edited the pipeline do to so.
Worked fine too.

But now, the timestamp from SOC and ElasticSearch is different, See screenshot

The @ timestamp field on log is the correct one, and the SOC Timestamp is wrong

Edit 1: The pipeline came back to ingest in wrong timezone

[InfosecGoon]

I'm seeing something similar on my own Fortinet logs -- in my case, the difference is UTC vs. local time zone. Is it the same for you?