ruby.rb

filter {
    grok {
	....
    }
    ruby {
        code => "
        begin
                event['JobStart_ts'] = event['StartTime']
                event['JobEnd_ts'] = event['EndTime']
                event['JobNumber'] = event['JobId']
                rescue Exception => e
                event['logstash_ruby_exception'] = '[JobNumber]: ' + e.message
        end
        "
     }

     date { match => [ "StartTime", "ISO8601" ] }
     ruby {
        code => "
        begin
                event['JobElapsedTime'] = ( ( event['JobEnd_ts'] - event['JobStart_ts'] ) ).to_f
                rescue Exception => e
                event['logstash_ruby_exception'] = '[JobElapsedTime]: ' + e.message
        end
        "
     }
...
}