- make TAI64N date pattern support '@'-prefixed times. Now both are

supported:
  @4000000050d506482dbdf024
  4000000050d506482dbdf024
- Add TAI64N date specs which pass.

lib/logstash/filters/date.rb

@@ -119,7 +119,12 @@ class LogStash::Filters::Date < LogStash::Filters::Base
         when "UNIX_MS" # unix epoch in ms
           parser = lambda { |date| org.joda.time.Instant.new(date.to_i).toDateTime }
         when "TAI64N" # TAI64 with nanoseconds, -10000 accounts for leap seconds
-          parser = lambda { |date| org.joda.time.Instant.new((date[1..15].hex * 1000 - 10000)+(date[16..23].hex/1000000)).toDateTime }
+          parser = lambda do |date| 
+            # Skip leading "@" if it is present (common in tai64n times)
+            date = date[1..-1] if date[0, 1] == "@"
+
+            org.joda.time.Instant.new((date[1..15].hex * 1000 - 10000)+(date[16..23].hex/1000000)).toDateTime 
+          end
         else
           joda_parser = org.joda.time.format.DateTimeFormat.forPattern(format).withOffsetParsed
           if(locale != nil) 

spec/filters/date.rb

@@ -160,4 +160,25 @@ describe LogStash::Filters::Date do
       # nothing to do, if this crashes it's an error..
     end
   end
+
+  describe "TAI64N support" do
+    config <<-'CONFIG'
+      filter {
+        date {
+          t => TAI64N
+        }
+      }
+    CONFIG
+
+    # Try without leading "@"
+    sample({ "@fields" => { "t" => "4000000050d506482dbdf024" } }) do
+      insist { subject.timestamp } == "2012-12-22T01:00:46.767Z"
+    end
+
+    # Should still parse successfully if it's a full tai64n time (with leading
+    # '@')
+    sample({ "@fields" => { "t" => "@4000000050d506482dbdf024" } }) do
+      insist { subject.timestamp } == "2012-12-22T01:00:46.767Z"
+    end
+  end
 end