What is the difference between event time and ingestion time?¶

Event time and ingestion time describe different points in the life of a log record.

Event time is when the source system says the underlying activity occurred. Ingestion time is when another platform received or processed that record.

Avoid this assumption: That those two times should always be the same. They often are not.

A device may create an event at 09:15, store it locally and forward it later. A collector may buffer the record. A network outage, API delay or overloaded platform may prevent immediate delivery. The receiving system might therefore ingest the event minutes or hours after the source recorded it.

That difference matters when reconstructing a sequence. Sorting by event time may show when the source believed activity occurred. Sorting by ingestion time may show when the monitoring platform became aware of it.

Neither field is automatically perfect. The source clock may be wrong. The ingestion platform may apply processing delays or timestamp conversion. Some dashboards display only one field, and the label may not make clear which one it is.

Investigators should identify both timestamps and establish which system created each one. Ask whether the event was buffered, uploaded in batches or forwarded through a collector. Preserve source time, ingestion time, time zone and any processing metadata.

Where several systems are being compared, do not mix event times from one source with ingestion times from another without recording the difference. A cluster of records ingested together may represent delayed delivery rather than simultaneous activity.

Operational takeaway¶

Event time describes when the source says activity occurred, while ingestion time describes when another platform received the record, and the difference can materially affect sequence and interpretation.