Even though the datetime field is parsed properly by logstash pipeline, every document in elasticsearch has
"tags": [
"_dateparsefailure"
],
So wondering why the tags field is getting populated with _dateparsefailure
Perhaps you have an extra file with an invalid date filter in /etc/logstash/conf.d (or wherever you keep your config files)? If you increase the loglevel Logstash will tell you exactly what configuration it loads. Make sure it's what you expect.