My bad. I made an elementary mistake ![]()
Here's my new filter. I didn't take into account "MMM d HH:mm:ss"
filter {
if [logsource] =~ "esxs0[1,2].*" {
date {
match => [ "timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss" ]
locale => "en"
timezone => "UTC"
}