Yes, but where are the values coming from? What is the data type of the contents of the fields? Your example, "August 8th 2016, 03:52:35.000", looks like something that Kibana has formatted for you. Output from a stdout { codec => rubydebug } output would be helpful.