title: Logstash date filter not updating @timestamp with Apache timestamp
body: <p>I'm trying to backfill some past Apache access log data with logstash, therefore I need the event @timestamp to be set to the date appearing in the log message. This is my current logstash configuration:</p>
  
  <pre><code>input {
      tcp {
          type =&gt; "access_log"
          port =&gt; 9293
      }
  }
  
  filter {
  
      grok {
        match =&gt; { "message" =&gt; "%{COMBINEDAPACHELOG}" }
      }
  
      date {
        # Try to pull the timestamp from the 'timestamp' field (parsed above with
        # grok). The apache time format looks like: "18/Aug/2011:05:44:34 -0700"
        locale =&gt; "en"
        timezone =&gt; "America/New_York"
        match =&gt; { "timestamp" =&gt; "dd/MMM/yyyy:HH:mm:ss Z" }
        add_tag =&gt; [ "tsmatch" ]
      }
  
  }
  
  output {
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>However, the date filter doesn't seem to update the event @timestamp, even though the Apache timestamp is catched correctly and the regular expression should match it. The output data looks like this:</p>
  
  <pre><code>{
          "message" =&gt; "56.116.21.231 - - [20/Nov/2013:22:47:08 -0500] \"GET /xxxx/1.305/xxxx/xxxx.zip HTTP/1.1\" 200 33002333 \"-\" \"xxxxx/3.0.3 CFNetwork/609.1.4 Darwin/13.0.0\"",
       "@timestamp" =&gt; "2013-12-01T12:54:27.920Z",
         "@version" =&gt; "1",
             "type" =&gt; "access_log",
             "host" =&gt; "0:0:0:0:0:0:0:1%0:51045",
         "clientip" =&gt; "56.116.21.231",
            "ident" =&gt; "-",
             "auth" =&gt; "-",
        "timestamp" =&gt; "20/Nov/2013:22:47:08 -0500",
             "verb" =&gt; "GET",
          "request" =&gt; "/xxxx/1.305/xxxx/xxxx.zip",
      "httpversion" =&gt; "1.1",
         "response" =&gt; "200",
            "bytes" =&gt; "33002333",
         "referrer" =&gt; "\"-\"",
            "agent" =&gt; "\"xxxxx/3.0.3 CFNetwork/609.1.4 Darwin/13.0.0\"",
             "tags" =&gt; [
          [0] "tsmatch"
      ]
  }
  </code></pre>
  
  <p>Any ideas on what could be wrong?</p>
  
  <p>I'm using the logstash-1.2.2 flatjar.</p>