I found the issue.
It is because of the date format in the date filter
I used "," instead of "." and use SSS intead of SSSSSS
And in case you do not need these milli or micro seconds you can use the gsub to remove the 6 or 3 numbers after the . before you give it to the date filter
--
Thanks all for your help
mutate
{
gsub => ["timestamp", "\.\d{6}", ""]
}
date
{
match => [ "timestamp" , "EEE MMM dd HH:mm:ss.SSSSSS yyyy" ]
}