handle nginx timestamp_msec

There is a weirdness trying to test that we are getting an ISO8601+msec
value out of @timestamp, hence the .to_json test. If a clearer way of doing
this exists, PR!