Math function in Logstash

[ashvita]

Hi,

I need to calculate 100-total. Which filter should I use?
This is the message that I receive - NE_217_225- Cpu(s): 16.6%us, 7.4%sy, 0.0%ni, 74.9%id, 1.0%wa, 0.0%hi, 0.0%si, 0.0%st
My grok filter is as follows-
grok {
match => ['message', '%{DATA:NodeIP}-%{SPACE}%{DATA:CPU}: %{NUMBER:user:int}%{DATA}, %{NUMBER:system:int}%{DATA}, %{NUMBER:nicedUser:int}%{DATA}, %{NUMBER:ideal:int}%{DATA}, %{NUMBER:waiting:int}%{DATA}, %{NUMBER:HwdInt:int}%{DATA}, %{NUMBER:SoftInt:int}%{DATA}, %{NUMBER:stolenTime:int}%{DATA}']
}

Now I want a new field with 100-ideal.
How should I go ahead?

Thanks

[rkhapre (RK)]

Use ruby filter. There are many example in this forum for it

[magnusbaeck (Magnus Bäck)]

Unrelated to your question, but don't use DATA patterns like that. It can result in severe performance problems. Use a more exact expression instead