See https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358 for some discussion

For confirmed bugs, please report:

• Version: filebeat-6.4.2-1.x86_64
• Operating System: EL7

SUSE apparently is using:

2018-08-14T14:30:02.203151+02:00

I'm seeing it as well with rsyslog native timestamp on RHEL 7, which I suspect is what SUSE is using.