Yes rsyslog adds the first timestamp as I have configured it to. But it does not add the second. So is it a feature or bug, that you can configure nginx to send timestamp on acccess_log but not on error_log?