I've been playing around with the new Meraki fileset in the Cisco module, and have noticed that for some event types, the date is not properly parsed, and i get a @timestamp of '1970-01-01T00:00:03.000Z'. Here is a sample original log entry:
Dec 3 12:03:30 HOSTNAME 1 1607025810.308975186 HOSTNAME events type=disassociation radio='1' vap='3' client_mac='00:00:00:00:00:00' channel='48' reason='4' duration='362.778560402' auth_neg_dur='0.003999999' last_auth_ago='362.758560400' is_wpa='1' arp_resp='29.995999997' arp_src='1.2.3.4' aid='1291454018'
from what i have noticed, it is when 'events' follows the hostname. other type of events (flows, etc.) parse successfully.