Define an event.age field

[PhaedrusTheGreek]

It's often necessary to track the lag/delay between @timestamp and event.ingested. When this is done , it's stored in milliseconds . I have been using the event.age field as it seems appropriate, and it could be defined as : "Difference in seconds between ingested time and source event time" : float

This value is often calculated using the Logstash age filter or simply Time.now.to_f - event.timestamp.to_f

[rsk0]

Having a field for how long a log record takes to travel through a logs pipeline would be valuable!

(It's something my team's implemented, but not well.)

A few more ways to phrase this concept in case it helps: {delivery,transit} x {speed,time,duration}. Explicated for your convenient review:

• delivery speed
• delivery time
• delivery duration
• transit speed
• transit time
• transit duration

I think the terms 'delivery' and 'duration' do the best jobs of conveying the concepts at hand.

I've been at a bit of a loss for how to categorize this information. See this other issue, #2258, regarding organization possibilities.