input { pipeline { address => outbytes } } filter{ mutate { add_field => [ "CW_metricname" , "BytesOut" ] add_field => [ "CW_value" , "%{iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.2}" ] add_field => [ "CW_unit" , "Bytes" ] } } output { pipeline { send_to => [cloudwatch] } }