Count length of field / number of characters in a field and add the result into a new field

[Eniqmatic (Lewis Barclay)]

Can you try this:

filter {
   if [log_name] == "Microsoft-Windows-Sysmon/Operational" {
      ruby {
	     code => "event['processcreate'] = event['process_command_line'].length"
	  }   
   }
}