Convert @timestamp date format

[Badger]

For the latter, this does what I think you want...

  mutate { add_field => { "datetime" => "%{@timestamp}" } }
  mutate { gsub => [ "datetime", ".000Z$", "+0000" ] }