input { pipeline { address => inbytes } } filter{ mutate { add_field => [ "CW_metricname" , "BytesIn" ] add_field => [ "CW_value" , "%{iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.2}" ] add_field => [ "CW_unit" , "Bytes" ] } } output { pipeline { send_to => [cloudwatch] } }