Logstash: Update a string value in message filed using filters

I have a json message from the lambda logstream where the application is already producing @timestamp value but its not in the expected format. So if i use json filter to parse the message filed its producing the error message "nrecognized @timestamp value, setting current time to @timestamp, original in _@timestamp" , Since we have lot of logs produced by the lambda functions this error message logging caused the logstash instance ran out of disk..

"logStream": "2019/09/12/e79f4e6fd779dcfe60",
"message": "{\"@timestamp\": \"2019-09-12 09:18:25.662\", \"priority\": \"INFO\" }

So we want timestamp message filed to be changed to logstash format before using the json filter to parse the message field ?. How can i change the @timestamp using gsub or other filters ?

expected output and input to json filter:

\"@timestamp\": \"2019-09-12 09:18:25.662\"

\"@timestamp\": \"2019-09-12T09:18:25.662Z\"

"message": "{\"@timestamp\": \"2019-09-12T09:18:25.662Z\", \"priority\": \"INFO\" }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.