问个logstash date 处理日志的问题

filter {
    multiline {
         pattern => "^\s*$"
         what => "previous"
         negate => true
    }
    grok {
        patterns_dir => "/etc/logstash/patterns"
        match => { "message" => "%{GREEDYDATA:message}" }
        overwrite => ["message"]
    }
    mutate {
        gsub => ["message", "\n", " "]
        split => ["message", " "]
    }
    date {
        match => ["%{message[0]}","ISO8601", "UNIX" ]
    }
}

输出结果是
{
       "message" => [
        [0] "2015-12-03T01:33:22+00:00",
        [1]
        [2]
        [3]
        [4] "2015-12-03T01:33:25+00:00",
        [5]
        [6]
        [7]
    ],
   "@version" => "1"
   ............
}

我这样%{message[0]}  和 %{[message][0]}  都匹配不到 message[0]里面额值，做data match， 这个要怎么做呢。