# \[SOLVED\] Doing conversion byte to mega byte with logstash

**URL:** <https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002>\
**Category:** Logstash\
**Created:** [June 27, 2016, 7:12am UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002 "2016-06-27T07:12:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Lum](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_lum/32/84472_2.png) [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\
**Post date:** [June 27, 2016, 7:12am UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002/1 "2016-06-27T07:12:56Z")

</div>

Hello all.  
I m doing a real time monitor for fortinet bandwith but sent and received packets are in byte.  
I make a sum of all but it's not easy readable in byte.  
So i need to convert all bytes in megabytes.

Here's my conf file.

> input {  
> file {  
> path =\> "/var/log/fortigate100D"  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> grok {  
> match =\> { "message" =\> "date=%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} time=%{TIME:time} devname=%{HOSTNAME:devname} devid=%{HOSTNAME:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} level=%{WORD:level} vd=%{WORD:vd} srcip=%{IP:srcip} srcport=%{NUMBER:srcport} srcintf="%{WORD:srcintf}" dstip=%{IP:dstip} dstport=%{NUMBER:dstport} dstintf="%{WORD:dstintf}" poluuid=%{UUID:poluuid} sessionid=%{NUMBER:sessionid} proto=%{NUMBER:proto} action=%{WORD:action} policyid=%{NUMBER:policyid} policytype=%{DATA:policytype} dstcountry="%{DATA:dstcountry}" srccountry="%{DATA:srccountry}" trandisp=%{WORD:trandisp} transip=%{IP:transip} transport=%{NUMBER:transport} service="%{WORD:service}" duration=%{NUMBER:duration} sentbyte=%{NUMBER:sentbyte} rcvdbyte=%{NUMBER:rcvdbyte} sentpkt=%{NUMBER:sentpkt} rcvdpkt=%{NUMBER:rcvdpkt} appcat="%{WORD:appcat}"" }  
> }  
> grok {  
> match =\> { "message" =\> "date=%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} time=%{TIME:time} devname=%{HOSTNAME:devname} devid=%{HOSTNAME:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} eventtype=%{WORD:eventtype} level=%{WORD:level} vd=%{WORD:vd} policyid=%{NUMBER:policyid} sessionid=%{NUMBER:sessionid} user="" srcip=%{IP:srcip} srcport=%{NUMBER:srcport} srcintf="%{WORD:srcintf}" dstip=%{IP:dstip} dstport=%{NUMBER:dstport} dstintf="%{WORD:dstintf}" proto=%{NUMBER:proto} service=%{WORD:service} hostname="%{DATA:URLCible}" profile="%{DATA:profilePROXY}" action=%{WORD:action}" }  
> }  
> mutate {  
> convert =\> ["rcvdbyte", "integer"]  
> convert =\> ["sentbyte", "integer"]  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> index =\> "forti100d-logstash-%{+YYYY.MM.dd}"  
> }  
> }

thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 29, 2016, 12:46am UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002/2 "2016-06-29T00:46:53Z")

</div>

You might be better off to use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) instead of grok.

However to do what you want you would need to insert some ruby code to do the translations.

---

<div class="post-metadata">

**Author:** ![Alex\_Lum](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_lum/32/84472_2.png) [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\
**Post date:** [June 29, 2016, 7:26am UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002/3 "2016-06-29T07:26:34Z")

</div>

Thank you.  
I will try kv plugin.  
have you got an example of ruby code to do conversion?

---

<div class="post-metadata">

**Author:** ![Alex\_Lum](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_lum/32/84472_2.png) [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\
**Post date:** [June 29, 2016, 3:09pm UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002/4 "2016-06-29T15:09:41Z")

</div>

Hello,  
I've used this :

> [@Kibana dashboard for Interface Traffic analysis](https://discuss.elastic.co/t/kibana-dashboard-for-interface-traffic-analysis/26204/9):
>
> Sure - If your bytes field is called "IN\_BYTES", you can use the following script: doc['IN\_BYTES'].value\*8 Some screenshots below from my environment (my bytes field is called 'bytes')

Thank you for help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/solved-doing-conversion-byte-to-mega-byte-with-logstash/54002/5 "2017-07-06T04:50:23Z")

</div>