Logstash datetime filter if else

A date filter converts the field to a LogStash::Timestamp, and what you have there is the string representation of such an object. If your fields are type date in elasticsearch then they are stored as milliseconds since the UNIX epoch in UTC.

If you want the field stored as a string in a particular format then use strftime.