There is no reason to use class or even instance variables here. You can use local variables. In fact, that might be the problem. If a message is missing one of req_created or req_ended it will use the value from the previous message. Personally I would use a date filter to parse the timestamps.
date { match => [ "req_created", "ISO8601" ] target => "req_created" }
date { match => [ "req_ended", "ISO8601" ] target => "req_ended" }
ruby {
code => '
duration = 0.0
ended = event.get("req_ended")
created = event.get("req_created")
if created and ended then
duration = ended.to_f - created.to_f
end
event.set("req_duration_sec", duration)
'
}