Logstash config for fhem

5-fhem.conf

filter {
    if [type] == "fhem" {
        grok {
            match => { "message" => "%{NOTSPACE:timestamp} %{NOTSPACE:device} %{GREEDYDATA:event}" }
        }

        grok {
            match => {
                "device" => "%{DATA:protocol}_%{DATA:manufacturer}_%{DATA:device_type}_%{INT:device_number:int}"
            }
        }

        translate {
            field => "device"
            dictionary => {
                "ZWave_Devolo_Socket_01"        => "office"
                "ZWave_Devolo_Socket_02"        => "boiler room"
                "ZWave_Devolo_Socket_03"        => "living room"
                "JeeLink_ELV_Socket_01"         => "servers"
                "ZWave_Aeotec_multisensor_01"   => "outside"
                "ZWave_Aeotec_multisensor_02"   => "office"
                "ZWave_Aeotec_multisensor_03"   => "corridor"
                "ZWave_Aeotec_multisensor_04"   => "bedroom"
                "ZWave_Aeotec_multisensor_05"   => "kitchen"
                "ZWave_Aeotec_multisensor_06"   => "living room"
                "ZWave_Aeotec_multisensor_07"   => "attic"
                "ZWave_Aeotec_multisensor_08"   => "bathroom"
                "ZWave_Aeotec_multisensor_09"   => "kids room"
                "CUL_ELV_HMS100TF_01"           => "wash room"
                "CUL_ELV_HMS100TF_02"           => "cellar stairwell"
                "CUL_ELV_EM1000s_01"            => "first floor"
                "CUL_ELV_EM1000s_02"            => "ground floor"
                "CUL_ELV_EM1000gz_01"           => "water mains"
            }
            destination => "location"
        }

        date {
            # 2015-05-15_14:08:55
            match => [ "timestamp", "YYYY-MM-dd_HH:mm:ss" ]
            remove_field => [ "timestamp" ]
        }

        if [manufacturer] == "ELV" and [device_type] == "HMS100TF" {
            grok {
                match => {
                    "event" => [
                        "humidity: %{NUMBER:humidity:float}",
                        "battery: %{GREEDYDATA:battery_state}",
                        "temperature: %{NUMBER:temperature:float}"
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => [ 'drop' ]
            }

            # Other devices report battery values as numeric 0-100 range, normalise this "ok" to 99
            if [battery_state] {
                if [battery_state] == "ok" {
                    mutate {
                        add_field => { "battery" => 99 }
                    }
                } else {
                    mutate {
                        add_field => { "battery" => 1 }
                    }
                }
                mutate {
                    convert => { "battery" => "integer" }
                    remove_field => [ "battery_state" ]
                }
            }
        }

        if [manufacturer] == "Aeotec" and [device_type] == "multisensor" {
            grok {
                match => {
                    "event" => [
                        "humidity: %{NUMBER:humidity:float} ",
                        "dewpoint: %{NUMBER:dew_point:float}",
                        "battery: %{NUMBER:battery:float} ",
                        "temperature: %{NUMBER:temperature:float} ",
                        "luminance: %{NUMBER:luminance:float} "
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => []
            }
            if [event] == "alarm: HomeSecurity: Motion Detection, arg 010700" or [event] == "basicSet: ff" {
                mutate {
                    add_field => { "motion" => 1 }
                }
            }else if [event] == "alarm: HomeSecurity: Event cleared: Motion Detection" or [event] == "basicSet: 00" {
                mutate {
                    add_field => { "motion" => 0 }
                }
            }

            if [motion] {
                mutate {
                    convert => { "motion" => "integer" }
                }
            }
        }

        if [manufacturer] == "ELV" and [device_type] == "EM1000gz" {
            grok {
                match => {
                    "event" => [
                        # CNT: 41 CUM: 530010.000  5MIN: 0.000  TOP: 0.000
                        "^CNT:\s+%{INT:sequence_number:int}\s+CUM:\s+%{NUMBER:liter_cumulative:float}\s+5MIN:\s%{NUMBER}\s+TOP:\s%{NUMBER}"
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => [ 'drop' ]
            }
            aggregate {
                task_id => "%{device}"
                map_action  => "create_or_update"
                code => "map['previous_liter'] ? event['liter'] = event['liter_cumulative'] - map['previous_liter'] : 0; map['previous_liter'] = event['liter_cumulative']; "
            }
        }
         
        if [manufacturer] == "ELV" and [device_type] == "EM1000s" {
            grok {
                match => {
                    "event" => [
                        # CNT: 228 CUM: 174.547  5MIN: 0.320  TOP: 0.286
                        "^CNT:\s+%{INT:sequence_number:int}\s+CUM:\s+%{NUMBER:kwh_cumulative:float}\s+5MIN:\s%{NUMBER:power_kw:float}\s+TOP:\s%{NUMBER:peak_power_kw:float}"
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => [ 'drop' ]
            }
            if [power_kw] {
                # TODO calculate should be able to deal with numbers, not just field names
                mutate {
                    add_field => { "multiplier" => 1000 }
                }
                mutate {
                    convert => { "multiplier" => "integer" }
                }
                math {
                    calculate => [
                        [ "mpx", "power_kw", "multiplier", "power" ],
                        [ "mpx", "peak_power_kw", "multiplier", "peak_power" ]
                    ]
                }
                mutate {
                    remove_field => [ "multiplier", "peak_power_kw", "power_kw" ]
                }
            }else{
                mutate {
                    add_tag => [ "no_power_kw_found" ]
                }
            }
        }

        if [manufacturer] == "ELV" and [device_type] == "Socket" {
            grok {
                match => {
                    "event" => [
                        "power:\s*%{NUMBER:power:float}",
                        "consumptionTotal:\s*%{NUMBER:kwh_cumulative:float}"
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => []
            }
            # I don't know what the consumption really is - it doesn't seem to match Wh or KWh...
            # "consumption:\s*%{NUMBER:usage:float}"
            if [event] =~ "consumption:" {
                drop{}
            }
        }

        if [manufacturer] == "Devolo" and [device_type] == "Socket" {
            grok {
                match => {
                    "event" => [
                        "power:\s*%{NUMBER:power:float} ",
                        "energy:\s*%{NUMBER:kwh_cumulative:float} ",
                        "reportedState: %{DATA:state}"
                    ]
                }
                remove_field => [ "event" ]
                tag_on_failure => []
            }
        }
        
        if [device] == "ZWave_Aeotec_multisensor_01" {
            mutate {
                add_field => {
                    "source"        => "home"
                    "forecast_type" => "current"
                    "hour_offset"   => 0
                }
                add_tag => [ "weather" ]
            }
            mutate {
                convert => { "hour_offset" => "integer" }
            }
        }

        if [kwh_cumulative] {
            aggregate {
                task_id => "%{device}"
                map_action  => "create_or_update"
                code => "map['previous_kwh'] ? event['kwh'] = event['kwh_cumulative'] - map['previous_kwh'] : 0; map['previous_kwh'] = event['kwh_cumulative']; "
            }
        }
    }
}