elastic / elastic/integrations

Add option to set event.created in integration/agent

Open
#11,578 1 comment 0 reactions 0 assignees View on GitHub
enhancement Integration:elastic_agent needs:triage Team:Elastic-Agent
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

I would like to see a possibility to add an option in the Elastic Agent to add a field `event.created` with the timestamp of ingestion of the event. That is, a timestamp before the other processors will be run.
That way we can see how long an event took to travel from the source to the agent (in case of a TCP input) and, when we add a field with a timestamp as last processor, we can actually see how long (all) the processors of a agent took to run.

I would be even nicer to be able to set it (optionally) in the input options of an integration.

A diagram of the idea:
```mermaid
flowchart LR
DataSource[Data Source] --> ElasticAgent
subgraph ElasticAgent [Elastic Agent]
SetEventCreated[Set event.created] --> BuiltInProcessors[Built-in Processors]
BuiltInProcessors --> UserProcessors[User Processors]
UserProcessors --> SetEventAgentOut[Set event.agent_out]
end
ElasticAgent --> Output[Output]

classDef plain fill:#fff,stroke:#333,stroke-width:2px, border-radius: 5px;
classDef fancy fill:#f9f7f7,stroke:#333,stroke-width:2px, border-radius: 5px;
classDef agentBox fill:#83a4d4,fill-opacity:0.7,stroke:#333,stroke-width:2px, border-radius: 5px,stroke-dasharray: 5 5;
classDef operation fill:#f7d1ba,stroke:#333,stroke-width:2px, border-radius: 5px;

class DataSource,Output plain;
class ElasticAgent agentBox;
class SetEventCreated,BuiltInProcessors,UserProcessors,SetEventAgentOut operation;
```

Edit: Clarified

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.