ServerManagementUtils/logstash/conf.d/22-disk-usage.conf

filter {
  if [type] == "disk" {
    # Parse the message: "timestamp mount_point used_bytes total_bytes"
    # Mount points can have spaces, so we use grok with greedy matching
    grok {
      match => { 
        "message" => "^%{TIMESTAMP_ISO8601:timestamp}\s+(?<system.disk.mount_point>.*?)\s+%{NUMBER:system.disk.used:int}\s+%{NUMBER:system.disk.total:int}$"
      }
    }

    date {
      match => ["timestamp", "ISO8601"]
      target => "@timestamp"
      remove_field => ["timestamp"]
    }

    mutate {
      convert => { 
        "system.disk.used" => "integer"
        "system.disk.total" => "integer"
      }
    }

    ruby {
      code => "
        used = event.get('system.disk.used').to_f
        total = event.get('system.disk.total').to_f
        if total > 0
          percentage = (used / total) * 100
          event.set('system.disk.usage_percent', percentage.round(2))
        end
      "
    }

    ruby {
      code => "
        def bytes_to_human(bytes)
          units = ['B', 'KB', 'MB', 'GB', 'TB']
          return '0 B' if bytes == 0
          
          exp = (Math.log(bytes) / Math.log(1024)).floor
          exp = [exp, units.length - 1].min
          
          size = bytes / (1024.0 ** exp)
          unit = units[exp]
          
          if size >= 100
            '%.0f %s' % [size, unit]
          elsif size >= 10
            '%.1f %s' % [size, unit]
          else
            '%.2f %s' % [size, unit]
          end
        end

        used_bytes = event.get('system.disk.used')
        total_bytes = event.get('system.disk.total')
        
        if used_bytes
          event.set('system.disk.used_human', bytes_to_human(used_bytes))
        end
        
        if total_bytes
          event.set('system.disk.total_human', bytes_to_human(total_bytes))
        end
      "
    }
  }
}