Problem with combining xmlfilter and ruby code to compute a time difference

Elastic Stack Logstash
2

There is no reason to use class or even instance variables here. You can use local variables. In fact, that might be the problem. If a message is missing one of req_created or req_ended it will use the value from the previous message. Personally I would use a date filter to parse the timestamps.

    date { match => [ "req_created", "ISO8601" ] target => "req_created" }
    date { match => [ "req_ended", "ISO8601" ] target => "req_ended" }
    ruby {
        code => '
            duration = 0.0
            ended = event.get("req_ended")
            created = event.get("req_created")
            if created and ended then
                duration = ended.to_f - created.to_f
            end
            event.set("req_duration_sec", duration)
        '
    }