I made a more modern implementation of this formula at https://github.com/johnkeates/filebeat-formula it might be worth rebasing this one on top of that.