elastic / elastic/integrations
Add option to set event.created in integration/agent
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
I would like to see a possibility to add an option in the Elastic Agent to add a field `event.created` with the timestamp of ingestion of the event. That is, a timestamp before the other processors will be run.
That way we can see how long an event took to travel from the source to the agent (in case of a TCP input) and, when we add a field with a timestamp as last processor, we can actually see how long (all) the processors of a agent took to run.
I would be even nicer to be able to set it (optionally) in the input options of an integration.
A diagram of the idea:
```mermaid
flowchart LR
DataSource[Data Source] --> ElasticAgent
subgraph ElasticAgent [Elastic Agent]
SetEventCreated[Set event.created] --> BuiltInProcessors[Built-in Processors]
BuiltInProcessors --> UserProcessors[User Processors]
UserProcessors --> SetEventAgentOut[Set event.agent_out]
end
ElasticAgent --> Output[Output]
classDef plain fill:#fff,stroke:#333,stroke-width:2px, border-radius: 5px;
classDef fancy fill:#f9f7f7,stroke:#333,stroke-width:2px, border-radius: 5px;
classDef agentBox fill:#83a4d4,fill-opacity:0.7,stroke:#333,stroke-width:2px, border-radius: 5px,stroke-dasharray: 5 5;
classDef operation fill:#f7d1ba,stroke:#333,stroke-width:2px, border-radius: 5px;
class DataSource,Output plain;
class ElasticAgent agentBox;
class SetEventCreated,BuiltInProcessors,UserProcessors,SetEventAgentOut operation;
```
Edit: Clarified
Contributor guide
Assessment
This issue has not been assessed yet.