LogStash, GROK and a Versa Appliance Log -

[Badger]

I think a better approach would be

dissect { mapping => { "message" => "%{[@metadata][timestamp]} %{someField}, %{[restOfLine]}" } }
kv { source => restOfLine field_split => ", " remove_field => [ "restOfLine" ] }
date { match => [ "[@metadata][timestamp]", ISO8601 ] }