Hi,
you can directly use arithmetic function using now() and seconds(), it’s not necessary to convert to long (which indeed doesn’t work, as your code):
rule "fix timestamp"
when
parse_date(value: to_string($message.timestamp), pattern: "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'") - seconds(3600) > now() ||
parse_date(value: to_string($message.timestamp), pattern: "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'") + seconds(3600) < now()
then
set_field("timestamp", now());
set_field("timestamp_corrected", "true");
end