Elapsed is the right filter to use for this...however there has to be a field that is unique and common to the thread in order for that to work properly (ie a thread or process number) plus you need to be able to define the start and stop.
Also, I would recommend changing "GREEDYDATA" to something more specific as GREEDYDATA is quite resource intensive. Use "NOTSPACE" or "DATA" if you can.
Going from your example %{date} %{hour} would evaluate to: 20-06-11 15:31:23,817 which is NOT ISO8601 format.
Change your date filter to: date { match => [ "[@metadata][ts]", "yy-MM-dd HH:mm:ss,SSS" ] }
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.