# Meveo date only use TIME. This filter add concatenate the date of the day and the time of meveo log filter { if "meveo" in [tags] { mutate { replace => { "timestamp" => "%{+YYYY-MM-dd}T%{timestamp}Z" } } } }