# Add new calculated field when processing file in logstash
**URL:** https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014
**Category:** Logstash
**Created:** [June 13, 2022, 10:15am UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014 "2022-06-13T10:15:57Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)
#### Post date: [June 13, 2022, 10:15am UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/1 "2022-06-13T10:15:57Z")
Hello,
I have the following configuration in Logstash to read data from a CSV file that I pass every day. I have it working correctly. My doubt is that I need to add a new field based on a mathematical function against an already created field.
The logstash configuration file is as follows:
```auto
input {
file {
path => "/etc/logstash/conf.d/*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
skip_header => "true"
separator => ","
columns => [
"user-id",
"date",
"last_login_date",
"assigned_quota",
"used_quota",
"number_files",
"number_shares",
"number_uploads",
"number_downloads"
]
remove_field => ["message"]
}
date {
match => ["date", "yyyy-MM-dd HH:mm:ss"]
target => ["@timestamp"]
}
date {
match => ["last_login_date", "yyyy-MM-dd HH:mm:ss"]
target => ["last_login_date"]
}
mutate {convert => ["assigned_quota", "integer"]}
mutate {convert => ["used_quota", "integer"]}
mutate {convert => ["number_files", "integer"]}
mutate {convert => ["number_shares", "integer"]}
mutate {convert => ["number_uploads", "integer"]}
mutate {convert => ["number_downloads", "integer"]}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "csv-%{+YYYY.MM.dd}"
}
stdout {}
}
```
What I want is to create a new field that is the result of the following mathematical function:
new\_field = assigned\_quota /1024
How can I do this?
Thank you very much in advance.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2022, 4:48pm UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/2 "2022-06-13T16:48:24Z")
I would do it using a ruby filter...
```
ruby { code => 'event.set("newfield", event.get("assigned_quota")/1024)' }
```
---
### Author:  [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)
#### Post date: [June 14, 2022, 6:52am UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/3 "2022-06-14T06:52:33Z")
> [@Badger](#):
>
> `code => 'event.set("newfield", event.get("assigned_quota")/1024)' }`
Thanks for the reply.
And I think that this part of ruby code I have tu put at the finished of filter code?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 14, 2022, 3:45pm UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/4 "2022-06-14T15:45:06Z")
Yes, the ruby filter would go at the end of the filter section.
---
### Author:  [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)
#### Post date: [June 15, 2022, 1:54pm UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/5 "2022-06-15T13:54:46Z")
Thanks!!! This help me.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2022, 1:55pm UTC](https://discuss.elastic.co/t/add-new-calculated-field-when-processing-file-in-logstash/307014/6 "2022-07-13T13:55:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.