Logstash Ruby filter to subtract difference between two timestamps in single event

[cschotke (Craig Schotke)]

I think you could just do something like:

ruby {
    init => "require 'time'"
    code => "event['time_difference'] = event['received_at'] - event['@timestamp'];"
}