Bytes calulcation

Elastic Stack Logstash
1

configuration file:

input {
file {
path => "/home/murugar/Documents/denim.csv"
type => "csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {
csv{
separator => ","
columns => ["Index No:", "Memory"]
}
grok {
# would like to put store_units_prefix and store_units_base in @metadata, too
match => { "Memory" => "^%{BASE10NUM:[@metadata][store_number]:float}(?<store_units_prefix>[kKmMgGtT])(?<store_units_base>[b])$" }
}
mutate {
add_field => {
"[@metadata][store_units_prefix]" => "%{store_units_prefix}"
"[@metadata][store_units_base]" => "%{store_units_base}"
}
remove_field => [ "store_units_prefix", "store_units_base" ]
}
if [@metadata][store_units_prefix] == "k" or [@metadata][store_units_prefix] == "K" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1024 } }
} else if [@metadata][store_units_prefix] == "m" or [@metadata][store_units_prefix] == "M" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1048576 } }
} else if [@metadata][store_units_prefix] == "g" or [@metadata][store_units_prefix] == "G" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1073741824 } }
} else if [@metadata][store_units_prefix] == "t" or [@metadata][store_units_prefix] == "T" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1099511627776 } }
}

I don't know how to specify type in mutate.add_field, so I convert it

mutate {
    convert => { "[@metadata][store_multiplier]" => "integer" }
}

create a new field with the size in bytes

mutate
{
add_field =>{ "[store_size]" => {"[@metadata][store_number]" * "[@metadata][store_multiplier]"}}
}
}

output {
# elasticsearch{
# hosts => "192.168.124.128:40200"
# index => "csv2"
# user => "es_admin"
# password => "#elk20#"
# }

    stdout
    {

    codec => rubydebug
    }


    }

i am geeting error in the line for bolded one.

input file is a csv file:

1, 100 gb
2, 2 kb
3, 40 mb

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.