Great! Why not! I will redo my experimentsand post results.
Basically, yesterday I was "chasing" the format basing on log results.
I tried with YYYY-MM-dd HH:mm:ss YYYY-MM-dd HH:mm:ss.SSS and so on
I remeber trying all combinations, but maybe I didnt or maybe I was fooled by the presence of old, unmatched entries...
Now that I have learn how to clear all entryes from the CLI I will save a log file and will try tomorrow once again.
You're right on the convenience of resolving the @timestamp mismatch... but the impact on accuracy is far minor when using logstash forwarder in my scenario... This is because log files are updated by a cron job from service servers to the AWSTATS server at noticeable intervals.
Logstash forwarder @timestamps will be closer to the log timestamp as they are sended to the server every few seconds... BUt at the end, I agree with you: a good job is a good job, and this has to work somehow!
Thanks again! best regards!