[LOGSTASH-2142] if data[@timestamp] is an array, take the first timestamp

otherwise simply use the correct timestamp