I have a json message from the lambda logstream where the application is already producing @timestamp value but its not in the expected format. So if i use json filter to parse the message filed its producing the error message "nrecognized @timestamp value, setting current time to @timestamp, original in _@timestamp" , Since we have lot of logs produced by the lambda functions this error message logging caused the logstash instance ran out of disk..
{
"logStream": "2019/09/12/e79f4e6fd779dcfe60",
"message": "{\"@timestamp\": \"2019-09-12 09:18:25.662\", \"priority\": \"INFO\" }
}
So we want timestamp message filed to be changed to logstash format before using the json filter to parse the message field ?. How can i change the @timestamp using gsub or other filters ?
expected output and input to json filter:
\"@timestamp\": \"2019-09-12 09:18:25.662\"
\"@timestamp\": \"2019-09-12T09:18:25.662Z\"
"message": "{\"@timestamp\": \"2019-09-12T09:18:25.662Z\", \"priority\": \"INFO\" }