If that is the output of stdout { codec => rubydebug } then given that sampletime is not surrounded by quotes, it is already a date. And date cannot parse a date. Use mutate+convert to make sampletime a string and then the ISO8601 shorthand should work.