Clarification on using "timestamp_override: event.ingested" with EQL sequence rules

Elastic Security
1

Hello,

I’m looking for clarification and guidance around the use of timestamp_override: event.ingested in EQL sequence rules.

From my understanding and search of official docs:

  • timestamp_override: event.ingested is recommended for many detection rules to handle delayed or backfilled data.

  • However, it seems not recommended (or intentionally avoided) for EQL sequence rules, as sequences rely on correct event ordering and maxspan semantics based on event time, not ingest time.

My questions are:

  1. Why exactly is timestamp_override: event.ingested discouraged for EQL sequence queries?
    Is it mainly due to ordering issues, maxspan misalignment, or risk of false positives?

  2. Does this restriction depend on log source characteristics?
    For example, would data sources with near‑real‑time ingestion still be unsafe, or is the recommendation universal?

  3. What is the preferred approach for EQL sequence rules when dealing with delayed ingestion?

    • Rely solely on @timestamp / event time?

    • Use timestamp_field instead?

    • Increase look‑back windows or model sequences differently?

Any explanation or best‑practice guidance for designing better EQL sequence rules across different data sources would be very helpful.

Thanks in advance!

1 Like