# Logstash: Update a string value in message filed using filters
**URL:** https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213
**Category:** Logstash
**Created:** [September 12, 2019, 9:27am UTC](https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213 "2019-09-12T09:27:41Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@chimbu3306](https://discuss.elastic.co/u/chimbu3306)
#### Post date: [September 12, 2019, 9:27am UTC](https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213/1 "2019-09-12T09:27:41Z")
I have a json message from the lambda logstream where the application is already producing @timestamp value but its not in the expected format. So if i use json filter to parse the message filed its producing the error message "nrecognized @timestamp value, setting current time to @timestamp, original in \_@timestamp" , Since we have lot of logs produced by the lambda functions this error message logging caused the logstash instance ran out of disk..
```
{
"logStream": "2019/09/12/e79f4e6fd779dcfe60",
"message": "{\"@timestamp\": \"2019-09-12 09:18:25.662\", \"priority\": \"INFO\" }
}
```
So we want timestamp message filed to be changed to logstash format before using the json filter to parse the message field ?. How can i change the @timestamp using gsub or other filters ?
expected output and input to json filter:
```
\"@timestamp\": \"2019-09-12 09:18:25.662\"
\"@timestamp\": \"2019-09-12T09:18:25.662Z\"
"message": "{\"@timestamp\": \"2019-09-12T09:18:25.662Z\", \"priority\": \"INFO\" }
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2019, 9:27am UTC](https://discuss.elastic.co/t/logstash-update-a-string-value-in-message-filed-using-filters/199213/2 "2019-10-10T09:27:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.