# Converting bytes to gb in logstash configuration file

**URL:** <https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026>\
**Category:** Logstash\
**Created:** [September 27, 2017, 8:24pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026 "2017-09-27T20:24:29Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 27, 2017, 8:24pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/1 "2017-09-27T20:24:29Z")

</div>

Hi All,

I have logstash conf file, where I have field with bytes but when I Load to Kibana I should see new field with bytes coverted to GB.

I tried using ruby filter but it is failing with error "[2017-09-27T15:16:43,456][ERROR][logstash.filters.ruby] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details."

here is my logstash conf file  
input {  
file {  
path =\> "/apps/mft/ELK/MBXLogFiles/IdentityTestingLog.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["Destination","MailboxName","BPId","MessageId","FileName","Bytes","Date","Time","Action"]  
}  
grok {  
match =\> ["MailboxName", "^/(?[^/,]+)"]  
}  
mutate {  
convert =\> { "Bytes" =\> "integer" }  
}  
if [Bytes]{  
ruby {  
code =\> "event['SizeinGB'] = event['Bytes']/1024/1024/1024"  
}  
}

}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> ["192.168.56.105:9200"]  
index =\> "23andme"  
document\_type =\> "mbxlogdoctype"  
}

}

could some one help me on this

Thanks  
Somu

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 27, 2017, 8:28pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/2 "2017-09-27T20:28:15Z")

</div>

Did you consult the Logstash breaking changes documentation as the error message suggests?

[https://www.elastic.co/guide/en/logstash/current/breaking-changes.html#\_ruby\_filter\_and\_custom\_plugin\_developers](https://www.elastic.co/guide/en/logstash/current/breaking-changes.html#_ruby_filter_and_custom_plugin_developers)

---

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 27, 2017, 8:37pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/3 "2017-09-27T20:37:55Z")

</div>

Hi Magnus,

Thank you for answering my question

I updated my conf file as per the documentation link which you shared, this time I didnt see any error but I see SizeinGb filed with value "0"

```
  "Bytes" => 704202516,
 "@timestamp" => 2017-09-27T20:35:53.479Z,
       "BPId" => "22720029",
   "@version" => "1",
       "host" => "sinode0",
   "SizeinGB" => 0,

```

here is my updated conf  
input {  
file {  
path =\> "/apps/mft/ELK/MBXLogFiles/IdentityTestingLog.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["Destination","MailboxName","BPId","MessageId","FileName","Bytes","Date","Time","Action"]  
}  
grok {  
match =\> ["MailboxName", "^/(?[^/,]+)"]  
}  
mutate {  
convert =\> { "Bytes" =\> "integer" }  
}  
if [Bytes]{  
ruby {  
code =\> "event.set('[SizeinGB]',event.get('Bytes')/1024/1024/1024)"  
}  
}

}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> ["192.168.56.105:9200"]  
index =\> "23andme"  
document\_type =\> "mbxlogdoctype"  
}

}

---

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 27, 2017, 8:46pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/4 "2017-09-27T20:46:29Z")

</div>

could you help me in getting bytes converted to GB..now I dont know what I am missing because I didnt see any error

---

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 27, 2017, 8:57pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/5 "2017-09-27T20:57:35Z")

</div>

Magnus,

this is intersting multiplication is working i.e..,

ruby {  
code =\> 'event.set("SizeinGB",event.get("Bytes")\*2)'  
}

but if i want division it is giving zero value

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 28, 2017, 3:38am UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/6 "2017-09-28T03:38:27Z")

</div>

704202516 / 1024 / 1024 / 1024 is 0.65583, which gets truncated to zero when doing integer arithmetic. You'll get the desired result if you call to\_f on the number of bytes, i.e. replace `event.get("Bytes")` with `event.get("Bytes").to_f`.

---

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 28, 2017, 2:31pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/7 "2017-09-28T14:31:14Z")

</div>

Thank you Magnus. I able to get now

nice to know about to\_f

I created visualization with date histogram monthly on x-axis, but some how it is showing too tip on x-axis for every 3 months not for every month though the vertical bars are showing for every month.

I uploaded the image..please see and let me know

 ![VerticalBar](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc36d283c53426b005561e26095eca27e9e96cbb.PNG)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 28, 2017, 2:47pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/8 "2017-09-28T14:47:39Z")

</div>

I'm not sure the x axis label distance is configurable. You should ask in the Kibana group.

---

<div class="post-metadata">

**Author:** ![somu411](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@somu411](https://discuss.elastic.co/u/somu411)\
**Post date:** [September 28, 2017, 2:51pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/9 "2017-09-28T14:51:09Z")

</div>

> [@magnusbaeck](#):
>
> I'm not sure the x axis label distance is configurable. You should ask in the Kibana group.

Thank you Magnus..I will ask in Kibana grop

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2017, 2:51pm UTC](https://discuss.elastic.co/t/converting-bytes-to-gb-in-logstash-configuration-file/102026/10 "2017-10-26T14:51:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.