The problem here was our pattern was too specific. @timestamp is intended to be a bit more flexible in the forms of ISO8601 times it accepts because non-logstash programs may generate it. Using the previous code (ISODateTimeFormat) makes the tests pass and should make users happy.