[LOGSTASH-883] add a filter for maths operations