Grok help needed

Elastic Stack Logstash
1

Hello Everyone,

I have the following record sets int the following format

Bytes pps bps flow

45678 12 1.2 M 1
2.2 M 12 231 1

I am trying to parse Bytes and bps fields in such a way, so that if it reads the number and M, it will 2.2 and multiply by 10^6, and if sees a decimal just do nothing.

How can do this?

Thanks, in advance

2

I actually got it working

I actually had to add another column to it Bpp

But in general I had to take care of all 4 combinations. Here is what it looks like if someone is interested

(^%{NUMBER:Bytes}%{SPACE}M%{SPACE} %{NUMBER:pps}%{SPACE}%{NUMBER:bps}%{SPACE}M%{SPACE}%{NUMBER:Bpp}%{SPACE}%{NUMBER:flows}|^%{NUMBER:Bytes}%{SPACE}M%{SPACE}%{NUMBER:pps}%{SPACE}%{NUMBER:bps}%{SPACE}%{NUMBER:Bpp}%{SPACE}%{NUMBER:flows}|^%{NUMBER:Bytes}%{SPACE}%{NUMBER:pps}%{SPACE}%{NUMBER:bps}%{SPACE}M%{SPACE}%{NUMBER:Bpp}%{SPACE}%{NUMBER:flows}|%{NUMBER:Bytes}%{SPACE}%{NUMBER:pps}%{SPACE}%{NUMBER:bps}%{SPACE}%{NUMBER:Bpp}%{SPACE}%{NUMBER:flows})