input { pipeline { address => systemuptime } } filter{ mutate { add_field => [ "CW_metricname" , "SysUpTime" ] add_field => [ "CW_value" , "%{iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.sysUpTimeInstance}" ] add_field => [ "CW_unit" , "None" ] } } output { pipeline { send_to => [cloudwatch] } }