ML doesn't really inherently handle this use case because the "duration" is undefined in the case where the Close event has never been received. Obviously, ML currently needs to see the values of things over time. There's no function that currently exists that accomplishes what you want.
However, you might be able to re-orient the data. Maybe there's a way to use a bucket script aggregation to, on the fly, calculate the delta in the Open/Close events in some routine bucket interval (see the requirements for using aggs for ML). And then analyze those values calculated by the aggregation with one of the standard functions in ML.
I'm not sure if you have a sensible way to segment the transactions (by type or by entity) and if the cardinality of that segmentation is reasonable enough to do this on-the-fly calculations.
Perhaps more info on your use case would be helpful.