Math function in Logstash

(Ashvita) #1


I need to calculate 100-total. Which filter should I use?
This is the message that I receive - NE_217_225- Cpu(s): 16.6%us, 7.4%sy, 0.0%ni, 74.9%id, 1.0%wa, 0.0%hi, 0.0%si, 0.0%st
My grok filter is as follows-
grok {
match => ['message', '%{DATA:NodeIP}-%{SPACE}%{DATA:CPU}: %{NUMBER:user:int}%{DATA}, %{NUMBER:system:int}%{DATA}, %{NUMBER:nicedUser:int}%{DATA}, %{NUMBER:ideal:int}%{DATA}, %{NUMBER:waiting:int}%{DATA}, %{NUMBER:HwdInt:int}%{DATA}, %{NUMBER:SoftInt:int}%{DATA}, %{NUMBER:stolenTime:int}%{DATA}']

Now I want a new field with 100-ideal.
How should I go ahead?


(Ritesh) #2

Use ruby filter. There are many example in this forum for it

(Magnus B├Ąck) #3

Unrelated to your question, but don't use DATA patterns like that. It can result in severe performance problems. Use a more exact expression instead

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.