Try this -
filter {
mutate {
add_field => { "message" => "%{typenameru}" }
convert => [ "datetime", "string" ]
}
date {
timezone => "Etc/UTC"
match => ["datetime" , "ISO8601", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
remove_field => [ "datetime", "timestamp" ]
}
}
For me it is helped.