# Filter type => "ci_ip_diagnostics"

if [@type] == "ci_ip_diagnostics_kv" {
  mutate {
    add_field => [ "@messagetmp", "DateTimeLogged=%{@message}" ]
  }

  kv {
    source => "@messagetmp"
    field_split => ","
  }

  mutate {
    rename => [ "ProcessDesc", "ProcessDescRaw" ]
  }

  csv {
    source => "ProcessDescRaw"
    target => "ProcessDesc"
    separator => "/"
    columns => [
      "Type",
      "Status",
      "Source"
    ]
  }

  # Temporary fix for invalid source data, see http://status.labs.cityindex.com/incidents/14k5zkgs1jcf
  # If this still exists after the source data (ETA end April 2014) then it is a BUG!
  if [DateTime] =~ "\+01:00" {
    mutate {
      gsub => [ 
       "DateTime", "\+01:00", "+00:00"
      ]
    }
  }
  # End Temporary fix

  if [StartDateTime] {
    date {
      match => [ "StartDateTime", "ISO8601" ]
    }
  } else if [DateTime] {
    date {
      match => [ "DateTime", "ISO8601" ]
    }
  } else {
    date {
      match => [ "DateTimeLogged", "ISO8601" ]
    }
  }

  mutate {
    convert => [ "Percentage", "float" ]
    convert => [ "TotalMs", "float" ]
    convert => [ "Value", "float" ]
    convert => [ "NoOfOrders", "integer" ]
  }

  #Drop tmp fields
  mutate {
    remove_field => [ "@messagetmp" ]
  }
}

# Filter type => "ci_ip_diagnostics"

if [@type] == "ci_ip_diagnostics_kv" {
  mutate {
    add_field => [ "@messagetmp", "DateTimeLogged=%{@message}" ]
  }

  kv {
    source => "@messagetmp"
    field_split => ","
  }

  mutate {
    rename => [ "ProcessDesc", "ProcessDescRaw" ]
  }

  csv {
    source => "ProcessDescRaw"
    target => "ProcessDesc"
    separator => "/"
    columns => [
      "Type",
      "Status",
      "Source"
    ]
  }

  if [StartDateTime] {
    date {
      match => [ "StartDateTime", "ISO8601" ]
    }
  } else if [DateTime] {
    date {
      match => [ "DateTime", "ISO8601" ]
    }
  } else {
    date {
      match => [ "DateTimeLogged", "ISO8601" ]
    }
  }

  mutate {
    convert => [ "Percentage", "float" ]
    convert => [ "TotalMs", "float" ]
    convert => [ "Value", "float" ]
    convert => [ "NoOfOrders", "integer" ]
  }

  #Drop tmp fields
  mutate {
    remove_field => [ "@messagetmp" ]
  }
}

Remove temporary fix for incorrect timezone in source data
Remove temporary fix for incorrect timezone in source data
