Management of illegal characters

You could parse it using a date filter. I believe that will get sent to elasticsearch in an acceptable format.

If not, you can reformat it using ruby. See this thread.

You could also reformat it using a more complex gsub, but that doesn't feel right to me.

mutate { gsub => [ "someField", "(\d{2})/(\d{2})/(\d{4}) (\d{2}:\d{2}:\d{2}):(\d{3})", "\3/\1/\2 \4.\5" ] }

Just looking at that makes my eyes bleed!