I wonder why the "config_parsers=>" shows "MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601" in the logstash.log even after restarting logstash which supposed to be "yyyy-MM-dd HH:mm:ss"?
Did you ever have the pattern set to "MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601"?