# Math function in Logstash

**URL:** <https://discuss.elastic.co/t/math-function-in-logstash/100721>\
**Category:** Logstash\
**Created:** [September 15, 2017, 6:56pm UTC](https://discuss.elastic.co/t/math-function-in-logstash/100721 "2017-09-15T18:56:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [September 15, 2017, 6:56pm UTC](https://discuss.elastic.co/t/math-function-in-logstash/100721/1 "2017-09-15T18:56:00Z")

</div>

Hi,

I need to calculate 100-total. Which filter should I use?  
This is the message that I receive - NE\_217\_225- Cpu(s): 16.6%us, 7.4%sy, 0.0%ni, 74.9%id, 1.0%wa, 0.0%hi, 0.0%si, 0.0%st  
My grok filter is as follows-  
grok {  
match =\> ['message', '%{DATA:NodeIP}-%{SPACE}%{DATA:CPU}: %{NUMBER:user:int}%{DATA}, %{NUMBER:system:int}%{DATA}, %{NUMBER:nicedUser:int}%{DATA}, %{NUMBER:ideal:int}%{DATA}, %{NUMBER:waiting:int}%{DATA}, %{NUMBER:HwdInt:int}%{DATA}, %{NUMBER:SoftInt:int}%{DATA}, %{NUMBER:stolenTime:int}%{DATA}']  
}

Now I want a new field with 100-ideal.  
How should I go ahead?

Thanks

---

<div class="post-metadata">

**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Post date:** [September 16, 2017, 2:17am UTC](https://discuss.elastic.co/t/math-function-in-logstash/100721/2 "2017-09-16T02:17:23Z")

</div>

Use ruby filter. There are many example in this forum for it

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 16, 2017, 5:10am UTC](https://discuss.elastic.co/t/math-function-in-logstash/100721/3 "2017-09-16T05:10:56Z")

</div>

Unrelated to your question, but don't use DATA patterns like that. It can result in severe performance problems. Use a more exact expression instead

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2017, 5:11am UTC](https://discuss.elastic.co/t/math-function-in-logstash/100721/4 "2017-10-14T05:11:16Z")

</div>

Closed on October 14, 2017, 5:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.