Headed into the `date` function the value of rt is formatted: 

Oct 21 2024 17:04:06 GMT+02:00 

Which includes the year and timezone which isn't accounted for in your match: "MMM d HH:mm:ss"

You can add yyyy to the match in order to capture the year: "MMM d yyyy HH:mm:ss"

To address the timezone you also need to add "ZZ" to the match; but we have additional work since the match engine does recognize "+02:00" as a valid timezone format, but does not recognize "GMT+02:00". 

Splitting that out and fully handling it with support for different timezones is surprisingly complex, but there's a good example of it in the default TRENDMICRO_AV parser if you want to investigate.

If your data consistently shows GMT+|-<offset> you can do a more limited solution that only covers that specific format by using gsub to remove "GMT" from the string.  Additionally we only want to remove 'GMT' if its followed by the offset, and re2 doesn't support lookaheads; so we need to wrap the gsub in an IF statement to get the full effect. 

  if [rt] != "" {
    if [rt] =~ " GMT[\\+-]" {
        mutate { gsub => ["rt", " GMT", " "]}
    }
    date {
      match => ["rt", "MMM d yyyy HH:mm:ss ZZ"]
      on_error => "date_error"
    }
  }

In my example I also removed the target and rebase arguments.  Target defaults to event_timestamp and doesn't need to be specified unless you are writing to a different timestamp.  Rebase is used when there isn't a year specified in the timestamp, your data includes a year so this shouldn't be used.

Oct 21 2024 17:04:06 GMT+02:00 

  if [rt] != "" {
    if [rt] =~ " GMT[\\+-]" {
        mutate { gsub => ["rt", " GMT", " "]}
    }
    date {
      match => ["rt", "MMM d yyyy HH:mm:ss ZZ"]
      on_error => "date_error"
    }
  }

works grat, thanks a lot!