Count licences

Elastic Stack Kibana
3

In input I have filebeat on the flexlm server, and my output is elasticsearch
Here is my running pipeline :

input {
  beats {
    port => 5044
  }
}
filter {
   
    #parse IN/OUT license lines
    if [message] =~ /OUT:/ or [message] =~ /IN:/ {
        
        grok {
             match => [ "message", "%{DATA:checkout_time} \(%{DATA:vendor}\) (?<in_out>(OUT|IN))\: \"%{DATA:feature_name}\" %{DATA:user_id}@%{USERNAME:client_machine}" ]
        }

        mutate {
               replace => ["message", "%{+YYYY-MM-dd HH:mm:ss Z} %{vendor} %{in_out} %{feature_name} %{user_id} %{client_machine}"]
        }
    } else { 
        drop { }
    }
}

output {
    elasticsearch {
      hosts => "http://elasticsearch:9200"
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

It seems to work for me

I tried to use metrics, but I found that it can only increase vars, not doing calculation
I want to have something like :
"new_message", "%{%{+YYYY-MM-dd HH:mm:ss Z} %{feature_name} %{count_current_used_license_of_feature_name}"

Thank you