@timestamp should be iso8601 to match logstash