We have this
https://github.com/discourse/discourse/blob/master/plugins/discourse-nginx-performance-report/lib/log_analyzer.rb#L11-L15
It is in ruby and probably easily portable to an elastic grok rule