Just upgraded to the latest version of ES and all of our event logs appear to be written in GMT. Where is a setting to change this to log local time?
Do you mean in the web reports? If you go into the web reports menu and choose Settings > Preferences, make sure it has the correct time zone listed there (blank time zone = it will use your browser's current time zone) and make sure you save if you change those settings.
It's also possible that your agents write in UTC time but your web reports don't read in UTC time, or vice versa, and that would throw off your searches/display results by a few hours. You can go into web reports menu under Settings > Profiles, and try to change the "UTC" checkbox in the database settings (click Submit to save) to see if that fixes the timestamps.
If you mean that the timestamps are wrong for email alerts instead, that's really strange and it would be helpful if you had an example such as whether it only happens from certain machines or all machines and so forth.