I tried running the following
The original "ad_time" filed like "ad_time": "20140428 150509"
After filtering to timestamp: "@timestamp": "2014-04-28T07:05:11.404Z"
And I find "tags": [ "tsmatch" ]. It means the date filter works. But why it couldn't replace the timestamp?
You cannot trust the add_tag of the date filter in 1.4.0, it will be fixed in 1.4.1 (see for details)
Also I ran your config from a test case and the result is as expected, @timestamp remains in UTC but with the correct value from ad_time field
Result of bin/logstash rspec spec/support.rb
Example record sent to output:
I still could not solve this problem. It was something wrong?
Excellent!! It works!! Thank you very much
It is because logstash need the "full" reference to your field as documented in http://logstash.net/docs/1.4.0/configuration#fieldreferences
Can you please try with
match => ["[eventdata][ad_time]", "YYYYMMdd HHmmss"]