您可以为开始和结束时间戳创建一个字段，然后使用范围查询来检索相关的文本数据。当您要对时间戳相关信息进行操作时，此方法允许进行更复杂的查询和筛选。
您还可以考虑使用Elasticsearch“date”数据类型作为时间戳，允许您对数据执行基于日期的查询和聚合。

input {
  file {
    path => "/path/to/your/file.srt"
    codec => plain {
      charset => "UTF-8"
    }
  }
}

filter {
  grok {
    match => { "message" => "(?<start_timestamp>\d{2}:\d{2}:\d{2},\d{3}) --> (?<end_timestamp>\d{2}:\d{2}:\d{2},\d{3})\s+(?<text>.*)" }
  }
  date {
    match => ["start_timestamp", "HH:mm:ss,SSS"]
    target => "@timestamp"
  }
  mutate {
    remove_field => ["message"]
    convert => { "start_timestamp" => "date_time" } #conversion into a date-field
    convert => { "end_timestamp" => "date_time" }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "your_index_name"
    .
    .
    .
  }
}

另一种方法是使用filebeat：

filebeat.inputs:
- type: filestream
  id: srt
  paths:
    - /usr/share/filebeat/*.srt
  parsers:
    - multiline:
        type: pattern
        pattern: '^\d+$'
        negate: true
        match: after

processors:
  - dissect:
      tokenizer: "%{index}\n%{start} --> %{stop}\n%{text}"
      field: "message"
      target_prefix: "dissect"
      trim_chars: "\n"
      trim_values: "right"
  - replace:
      fields:
        - field: "dissect.start"
          pattern: "^(\\d{2}):(\\d{2}):(\\d{2}),(\\d{3})"
          replacement: "$1 h$2 m$3 s$4 ms"
        - field: "dissect.start"
          pattern: " "
          replacement: ""
        - field: "dissect.stop"
          pattern: "^(\\d{2}):(\\d{2}):(\\d{2}),(\\d{3})"
          replacement: "$1 h$2 m$3 s$4 ms"
        - field: "dissect.stop"
          pattern: " "
          replacement: ""
  - decode_duration:
      field: "dissect.start"
      format: "seconds"
  - decode_duration:
      field: "dissect.stop"
      format: "seconds"
      
output.console:
  pretty: true