You can try by without using extract text and replace text .Use update record by using syslog reader as reader and json writer as writer then need to update the time stamp by using record path value./orig_timestamp in value use ${field.value:toDate():format("yyyy-MM-dd'T'HH:mm:ss.SSSZ")}