input {
  file {
    path => [ "/opt/perfdata-out.log" ]
    start_position => "beginning"
  }
}

filter {
    if "Open sockets" in [message] {
        grok {
            patterns_dir => ["/etc/logstash/patterns"]
            match => [ "message", "%{PERFDATATIME}%{PERFDATA_HOST}%{PERFDATA_SERVICE}%{PERFDATA_STATE}(?:used=%{PERFDATA_MATRIX3:socket_used}\s\w+=%{NUMBER:socket_tcp}\s\w+=%{NUMBER:socket_udp}\s\w+=%{NUMBER:socket_raw}|)" ]
            remove_field => [ "message", "host", "path" ]
        }
        date{
            match => [ "nagios_epoch", "UNIX_MS" ]
        }
        mutate {
            split => { "socket_used" => ";" }
        }
    }
    else if "HDD I/O" in [message] {
        grok {
            patterns_dir => ["/etc/logstash/patterns"]
            match => [ "message", "%{PERFDATATIME}%{PERFDATA_HOST}%{PERFDATA_SERVICE}%{PERFDATA_STATE}(?:sda_read=%{PERFDATA_MATRIX3:sda_read}\ssda_write=%{PERFDATA_MATRIX3:sda_write}|)" ]
            remove_field => [ "message", "host", "path" ]
        }
        date{
            match => [ "nagios_epoch", "UNIX_MS" ]
        }
        mutate {
            split => { "sda_read" => ";"
                    "sda_write" => ";"
                    }
        }
    }
    else if "CPU usage" in [message] {
        grok {
            patterns_dir => ["/etc/logstash/patterns"]
            match => [ "message", "%{PERFDATATIME}%{PERFDATA_HOST}%{PERFDATA_SERVICE}%{PERFDATA_STATE}(?:idle=%{PERFDATA_MATRIX3:cpu_idle}\suser=%{NUMBER:cpu_user}(.?)\ssystem=%{NUMBER:cpu_system}(.?)\siowait=%{NUMBER:cpu_iowait}(.?)\ssteal=%{NUMBER:cpu_steal}(.?)|)" ]
            remove_field => [ "message", "host", "path" ]
        }
        date{
            match => [ "nagios_epoch", "UNIX_MS" ]
        }
        mutate {
            gsub => ["cpu_idle", "%", ""]
            split => { "cpu_idle" => ";" }
        }
    }
    else {

        grok {
            patterns_dir => ["/etc/logstash/patterns"]
            match => [ "message", "%{PERFDATATIME}%{PERFDATA_HOST}%{PERFDATA_SERVICE}%{PERFDATA_STATE}%{GREEDYDATA:parameters}" ]
            remove_field => [ "message", "host", "path" ]
        }
        date{
            match => [ "nagios_epoch", "UNIX_MS" ]
        }
        mutate {
            split => { "parameters" => " " }
        }
    }
}

output {
    stdout {
            codec => rubydebug
      }
    file {
        flush_interval => 2
        create_if_deleted  => true
        codec => line { format => "%{nagios_epoch} Hostname:%{hostname} Type:%{nagios_service} Status:%{nagios_state} %{nagios_statelevel}" }
        path => [ "/opt/perfdata-sort.log" ]
         }
}