Filebeat iis module time taken field

Yes and event.duration

So if you look at the definition of event.duration here

event.duration

Duration of the event in nanoseconds . If event.start and event.end are known this value should be the difference between the end and start time.

type: long
format: duration

So it looks like it is turned from ms (probably what the `ctx.temp.duration) it is multiplied by 1,000,000 in the pipeline to become nanoseconds.

Take a look at a discussion in this thread