I did that using
ruby {
code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"
}
and ruby plugin gave me an error stating it was expecting a string.
then I separated them and it worked:
ruby {
code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
}
ruby {
code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"
}