I've found that elasticsearch doesn't support query time field extraction, like splunk for example..:
sourcetype=* POST| rex field=_raw "\"POST (?<url>.*) HTTP\/1\.1\" (?<status_code>[0-9]+) (?<body_size>[0-9]+) (?<response_time>[0-9]+)" | timechart span=1d avg(response_time) by url
and im trying to achieve a workaround: the only thing that i've found in the doc that seems to treat this argument is pattern capture token filter..
but i can't really understand how to use it and even if it's really something that can help me in my intent.
So, every suggest is welcome