Quick question (I couldnt figure it out in the docs) but search slow logs have a timestamp and a duration, for example:
[2020-01-23 12:04:38,000][WARN ][index.search.slowlog.query] [p17us101esn01] [indexample][3] took[1.0s], took_millis[334], types[record]
Is the timestamp the time after the duration? Or when it started? For example this started at 12:04:38 and took 1 second. Is this:
A) Started at 12:04:38 and finished at 12:04:39
OR
B) Started at 12:04:37 and finished at 12:04:38
Thanks