Date_time parsing error in Elastic Stack 7.0. Worked fine in 6.7


Bit of a strange problem. I was using Elastic Stack 6.7 and have recently created a new 7.0 cluster.

From Filebeat I feed the below log line into both of these versions of Logstash

Log line:

[INFO ] [2019-06-13 00:00:00,711] [] [akka.tcp://SP6@] Next poll in 10 seconds

Here is my logstash conf file - except for the output IP address, it is identical on both of my Elastic Stack instances.

input {
  beats {
    port => 5044

filter {
   grok {
     match => {
        "message" => "%{LOGLEVEL:log.level}\s*\] \[%{TIMESTAMP_ISO8601:log.datetime}\]%{GREEDYDATA:log.message}"

    date {
      match => [ "log.datetime", "YYYY-MM-dd HH:mm:ss,SSS" ]


output {
  elasticsearch {
    hosts => ""
    manage_template => false
    index => "mflow-%{+YYYY.MM.dd}"
    document_type => "mflow"

In Elastic Stack 6.7 the log file is successfully parsed by Logstash and I can see the output in Elasticsearch. Below is the index info from Elasticsearch. We can see that it successfully created an index of 12 records (there are 12 lines in the log file).

green open mflow-2019.06.13 JOv2398RQaab2RYu6EehqA 3 1 12 0 151.8kb 75.9kb

However, in Elastic Stack 7.0 I receive the below parsing error in Logstash for the same log line that was parsed successfully in v6.7:

[2019-06-13T13:23:17,587][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mflow-2019.06.13", :_type=>"mflow", :routing=>nil}, #<LogStash::Event:0xba49170>], :response=>{"index"=>{"_index"=>"mflow-2019.06.13", "_type"=>"mflow", "_id"=>"PhoBUWsBDHqLRRnGvp7M", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [log.datetime] of type [date] in document with id 'PhoBUWsBDHqLRRnGvp7M'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2019-06-13 00:00:00,711] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"date_time_parse_exception: Failed to parse with all enclosed parsers"}}}}}}

Can anyone suggest what the problem may be here?