The problem is that you're using the default index
value for your elasticsearch output, "logstash-%{+YYYY.MM.dd}", which requires that the @timestamp
field exists.
Can you temporarily replace your elasticsearch output with a stdout { codec => rubydebug }
output so we can see exactly what the events look like? The error indicates that the event that causes the crash lacks a @timestamp
field but the date filter should make sure that field exists.