date {
   # May 08 10:18:18 or May 8 10:18:18
   match => ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss"]
   target => "timestamp"
}