How to parse a TimeSpan value which displays the difference between to timestamps

Elastic Stack Logstash
7

That is telling you that the [subsecond] field does not exist. You could change the ruby code to

subsecond = event.get("subsecond")
if subsecond
    subsecond = subsecond.to_f / (10 ** subsecond.length)
    event.set("elapsed", 3600 * event.get("hours").to_f + 60 * event.get("minutes").to_f + event.get("seconds").to_f + subsecond)
end