filter {
  if [type] == "disk" {
    dissect {
      mapping => {
        "message" => "%{timestamp} %{system.disk.mount_point} %{system.disk.used} %{system.disk.total}"
      }
    }

    date {
      match => ["timestamp", "ISO8601"]
      target => "@timestamp"
    }

    mutate {
      convert => { 
        "system.disk.used" => "integer"
        "system.disk.total" => "integer"
      }
    }

    ruby {
      code => "
        used = event.get('system.disk.used').to_f
        total = event.get('system.disk.total').to_f
        if total > 0
          percentage = (used / total) * 100
          event.set('system.disk.usage_percent', percentage.round(2))
        end
      "
    }

    ruby {
      code => "
        def bytes_to_human(bytes)
          units = ['B', 'KB', 'MB', 'GB', 'TB']
          return '0 B' if bytes == 0
          
          exp = (Math.log(bytes) / Math.log(1024)).floor
          exp = [exp, units.length - 1].min
          
          size = bytes / (1024.0 ** exp)
          unit = units[exp]
          
          if size >= 100
            '%.0f %s' % [size, unit]
          elsif size >= 10
            '%.1f %s' % [size, unit]
          else
            '%.2f %s' % [size, unit]
          end
        end

        used_bytes = event.get('system.disk.used')
        total_bytes = event.get('system.disk.total')
        
        if used_bytes
          event.set('system.disk.used_human', bytes_to_human(used_bytes))
        end
        
        if total_bytes
          event.set('system.disk.total_human', bytes_to_human(total_bytes))
        end
      "
    }
  }
}