Drop milliseconds from timestamp

That should produce an error message (logstash.agent.configuration.invalid_plugin_register). Try

mutate { gsub => ["fechalog", "\.\d{4}$", ""] }