Logstash Grok - How to parse @timestamp field using HTTPDERROR_DATE pattern?
<p>My log file has this pattern:</p>

<pre><code>[Sun Oct 30 17:16:09 2016] [TRACE_HIGH] [TEST1] MessageTest1
[Sun Oct 30 17:16:10 2016] [TRACE_HIGH] [TEST2] MessageTest2
</code></pre>

<p>Pattern:</p>

<pre><code>\A\[%{HTTPDERROR_DATE}](?&lt;message&gt;(.|\r|\n)*)
</code></pre>

<p>Filter:</p>

<pre><code>filter {
  if [type] == "mycustomlog" {
    grok {
      match =&gt; { "message" =&gt; "\A\[%{HTTPDERROR_DATE}](?&lt;message&gt;(.|\r|\n)*)"}
    }
    date {
      # Format: Wed Jan 13 11:50:44.327650 2016 (GROK: HTTPDERROR_DATE)
      match =&gt; [ "timestamp", "EEE MMM dd HH:mm:ss yyyy"]     
    }
    multiline {
      pattern =&gt; "^%{SYSLOG5424SD}%{SPACE}"
      what =&gt; "previous"
      negate=&gt; true
    }
  }
} 
</code></pre>

<p><strong>I am trying to use my datetime log into @timestamp field, but I cannot parse this format into @timestamp. Why the date filter did not replace the @timestamp value?</strong></p>

<p><strong>My @timestamp is different from the log row:</strong></p>

<p>row[0]</p>

<ul>
<li>@timestamp: [Wed Nov 2 15:56:<strong>42</strong> 2016]  </li>
<li>message: [Wed Nov 2 15:56:<strong>41</strong> 2016]</li>
</ul>

<p><a href="https://i.stack.imgur.com/Y5GJG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y5GJG.png" alt="enter image description here"></a></p>

<p>I am following this tutorial:</p>

<p><a href="https://www.digitalocean.com/community/tutorials/adding-logstash-filters-to-improve-centralized-logging" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/adding-logstash-filters-to-improve-centralized-logging</a></p>

<p>Using:</p>

<p>Elasticsearch 2.2.x, Logstash 2.2.x, and Kibana 4.4.x</p>

<p>Grok Constructor Print:
<a href="https://i.stack.imgur.com/PlU98.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PlU98.png" alt="enter image description here"></a></p>