Add Mutate function for simple math

[pickypg]

The idea would be to add a few simple math mutate functions to avoid the use of Ruby filters for the simplest scenarios.

Note the || 0 there to avoid Nil values blowing things up.

ruby {
  code => "event.set('[my][total]', event.get('[my][value1]') || 0 + event.get('[my][value2]') || 0)"
}
ruby {
  code => "event.set('[my][inferred_field]', event.get('[my][total]') || 0 - event.get('[my][value4]') || 0)"
}

could be replaced by

mutate {
  math_add_fields => {
    "[my][total]" => [ "[my][value1]", "[my][value2]" ]
  }
  math_subtract_fields => {
    "[my][inferred_field]" => [ "[my][total]", "[my][value4]" ]
  }
}

I'm undecided how I feel about the subtraction being chainable (e.g., if I wanted to subtract a value5, should I just add it to the end of the array?) versus just running it multiple times. The addition should definitely behave that way.

[pickypg]

Possibly the subtraction should be exactly like the addition in that addition is effectively field += sum(fields), the subtraction could be field -= sum(fields). That might be the simplest and most straight forward way to implement it, with the value being set if it's Nil.

[guyboertje]

Robin Clarke has a PR on this filter logstash-plugins/logstash-filter-math#1
I have made some suggested improvements. Its in progress.