filter {
match => { "store" => "^%{[@metadata][store_number]:float}(?INT:before_memory)[kKmMgGtT])(?INT:after_memory[kKmMgGtT])(?NOTSPACE:total_memory[kKmMgGtT])" }
}
mutate {
add_field => {
"[@metadata][before_memory][INT:after_memory][NOTSPACE:total_memory]" => "%{INT:before_memory}","%{INT:after_memory}","%{NOTSPACE:total_memory}"
}
remove_field => [ "[before_memory][INT:after_memory][NOTSPACE:total_memory]" ]
}
if [@metadata][before_memory][INT:after_memory][NOTSPACE:total_memory] == "K" or [@metadata][before_memory][INT:after_memory][NOTSPACE:total_memory] == "K" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1024 } }
} else if [@metadata][before_memory][INT:after_memory][NOTSPACE:total_memory] == "M" or [@metadata][before_memory][INT:after_memory][NOTSPACE:total_memory] == "M" {
mutate { add_field => { "[@metadata][store_multiplier]" => 1048576 } }
}
mutate {
convert => { "[@metadata][store_multiplier]" => "integer" }
}