filter {
  ruby {
    code => "event['sum'] = event['number_field_1'] + event['number_field_2']"
  }
}