# Logstash regex option for match settings!
**URL:** https://discuss.elastic.co/t/logstash-regex-option-for-match-settings/60209
**Category:** Logstash
**Created:** [September 10, 2016, 9:04am UTC](https://discuss.elastic.co/t/logstash-regex-option-for-match-settings/60209 "2016-09-10T09:04:18Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gugansankar](https://discuss.elastic.co/u/gugansankar)
#### Post date: [September 10, 2016, 9:04am UTC](https://discuss.elastic.co/t/logstash-regex-option-for-match-settings/60209/1 "2016-09-10T09:04:18Z")
In my settings, JSON is an input data. I tried to use log timestamp as index @timestamp value. Its working for normal json too.
But regex not working for nested json timestamp field match.
Here is my config.
```
date {
match => ["[a-zA-Z0-9][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
```
Log file example:
{"SRV1": {"timestamp": "2016-09-09 00:30:40", "cpu": 90, "mem": 45, "disk\_free": 50}}
{"SRV2": {"timestamp": "2016-09-09 00:30:40", "cpu": 80, "mem": 43, "disk\_free": 64}}
Fyi,
This below configuration is working , but I have a 200 servers and its not possible to put 200 entries in the configuration. So I prefer to use regex on match settings.
```
date {
match => ["[SRV1][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
date {
match => ["[SRV2][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 11, 2016, 8:04pm UTC](https://discuss.elastic.co/t/logstash-regex-option-for-match-settings/60209/2 "2016-09-11T20:04:19Z")
This kind of regular expression matching isn't supported. I suggest you use a ruby filter to normalize each event by moving the server subfields (`timestamp`, `cpu`, `mem`, ...) into the top level of the event, or just rename the server name field to something consistent.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/logstash-regex-option-for-match-settings/60209/3 "2017-07-06T04:39:02Z")