Hi current mariadb 10.1 errror log is setup as follows:
2017-06-25 23:58:02 140290494706240 [Note] Server socket created on IP: '127.0.0.1'.
2017-06-26 0:00:07 140290494121728 [Note] Event Scheduler: Purging the queue. 0 events

The second one is wrong it should be
2017-06-26 00:00:07 140290494121728 [Note] Event Scheduler: Purging the queue. 0 events

no space and added one 0 why is that important ?
ELK stack doesn't recognize this and you have to add unique pattern just to filter that instead of using a standard DATESTAMP pattern.