Logstash Duration Filter This is a plugin for Logstash. Usage grok { match => {'message' => 'delay=(?<delay>.*)'} } if [delay] { duration { iso => 'delay' } }