experimentating with "elapsed" filter

Let's see if we can track elapsed time between events.
integrate "logstash contrib" for elapsed time; add to syslog parsing