logstash.sh

cat /var/log/logstash/logstash-plain.log  | grep -o "^\[.*\]\[DEBUG\]\[logstash.outputs.amazones\]" | awk  '{ gsub(/\[DEBUG\].*/, ""); print }' | sed 's/[][]//g' | sed 's/,.*//g' | python timediff.py

timediff.py

import dateutil.parser
import sys

counter = 0
ptime = None;
for line in sys.stdin:
    ctime = dateutil.parser.parse(line)

    if counter == 0:
        ptime = ctime
        print('[{}]: {}'.format(counter, '0:00:00'))
    else:
        dtime = ctime - ptime
        print('[{}]: {}'.format(counter, dtime))
        ptime = ctime

    counter +=1