I want to combine these two fields | (?<byte_read>(-|%{INT})) | (?<byte_written>(-|%{INT})) |
and want one field like tota_bytes=byte_read+byte_written , can someone guide me how to do it.
%{IP:client-ip}+ | %{WORD:protocol} | (?(i|o))+%{DATA:Stash_Unique_Identifier}x%{DATA:Request_Minutes_In_Day}x%{INT:request_number_since_last_restart}x%{INT:Number_Of_Requests_Being _Serviced_Concurrently_At_The_Start_Of_The_Request} | %{USER:user}+ | %{TIMESTAMP_ISO8601:date} | "(?:%{DATA:http-method}) /%{USERNAME:scm}/(?%{USERNAME:project}/%{USERNAME:repo})/git-upload-pack(?: HTTP/%{NUMBER:http-version})" | %{QS:referer}?(\s)%{QS:agent}? | (?(-|%{INT})) | (?<byte_read>(-|%{INT})) | (?<byte_written>(-|%{INT})) | %{GREEDYDATA:DB_TABLES} | (?(-|%{INT})) | (?(-|%{WORD})) |