diff --git a/main.go b/main.go
index dde58e7..d8793a8 100644
--- a/main.go
+++ b/main.go
@@ -1484,6 +1484,7 @@ type PrivilegedUsersPageData struct {
 type RawEventInsert struct {
 	Message string
 	SHA256  string
+	Time    time.Time
 }
 
 type EventCountBucketAgg struct {
@@ -4134,6 +4135,7 @@ INSERT INTO event_logs (
 		rawEvents = append(rawEvents, RawEventInsert{
 			Message: item.Message,
 			SHA256:  msgHash,
+			Time:    item.Time.UTC(),
 		})
 
 		norm := NormalizeEventXML(item.Message)
@@ -4323,15 +4325,18 @@ func insertRawEventsTx(ctx context.Context, tx *sql.Tx, firstEventID uint64, raw
 	}
 
 	var sb strings.Builder
-	args := make([]any, 0, len(rawEvents)*3)
+	args := make([]any, 0, len(rawEvents)*4)
 
 	sb.WriteString(`
 INSERT INTO event_log_raw
-(event_log_id, msg, msg_sha256, created_at)
+(event_log_id, ts, msg, msg_sha256, created_at)
 VALUES
 `)
 
 	for i, raw := range rawEvents {
+		if raw.Time.IsZero() {
+			return fmt.Errorf("raw event at index %d has zero timestamp", i)
+		}
 		if strings.TrimSpace(raw.Message) == "" {
 			return fmt.Errorf("raw event at index %d has empty message", i)
 		}
@@ -4343,10 +4348,11 @@ VALUES
 			sb.WriteString(",")
 		}
 
-		sb.WriteString("(?,?,?,UTC_TIMESTAMP(6))")
+		sb.WriteString("(?,?,?,?,UTC_TIMESTAMP(6))")
 
 		args = append(args,
 			firstEventID+uint64(i),
+			raw.Time.UTC(),
 			raw.Message,
 			raw.SHA256,
 		)