Logstash deal with 24:00 time representation

If you are parsing it with a date filter one option would be to mutate+gsub 24:00 to 23:59 before the date filter, and optionally use a ruby filter conditional upon the presense of 24:00 in the original field to add 60 seconds to the resulting date (using code similar to this).