# Retrieve json fields with regex
**URL:** https://discuss.elastic.co/t/retrieve-json-fields-with-regex/156039
**Category:** Logstash
**Created:** [November 9, 2018, 11:58am UTC](https://discuss.elastic.co/t/retrieve-json-fields-with-regex/156039 "2018-11-09T11:58:43Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@matpil](https://discuss.elastic.co/u/matpil)
#### Post date: [November 9, 2018, 11:58am UTC](https://discuss.elastic.co/t/retrieve-json-fields-with-regex/156039/1 "2018-11-09T11:58:43Z")
Hi all,
I'm trying to estract a value from my json log using a regex/wildcard into path field (so, it's generic to all my json log).
es. json log:
```
{
"appl": {
"hostname": "host14-26102017",
"containerid": "8410d663920a22fa5f256c440b714e437f69e395a940b31466c49060952a67bf",
"log": {
"MY_APP": {
"pid": "",
"timestamp": "2018-11-08 16:14:15.144",
"context": "perfStatsLogger",
"sid": "",
"message": {
"name": "cpu.usage",
"value": {
"value": 0.6200342049870466
},
"type": "GAUGE"
},
"service": "MY_APP",
"level": "INFO"
}
}
```
"MY\_APP" can change...
now I'd like to retrieve appl/log/MY\_\_APP/timestamp (and transform as date).
here my filter:
```
filter {
json {
source => "message"
target => "appl"
}
date {
match => ["[appl][log][*][timestamp]", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "timestamp"
}
}
```
...this solution not working and I receive this error:
Detected ambiguous Field Reference `[appl][log][*]timestamp]` , which we expanded to the path `[appl, log, *, timestamp]` ; in a future release of Logstash, ambiguous Field References will not be expanded.
Is there a way to resolve?
Any suggest?
## Regards
Matpil
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2018, 11:59am UTC](https://discuss.elastic.co/t/retrieve-json-fields-with-regex/156039/2 "2018-12-07T11:59:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.