While investigating on an event I noticed there was a huge difference between event.created and event.ingested which created a confusion on the real event time.
Later digging in docs resulted
event.ingested: timestamp when an event arrived in the central data store.
This is different from @timestamp, which is when the event originally occurred. It’s also different from event.created, which is meant to capture the first time an agent saw the event.
Now how do I prove that why elasticsearch is ingesting logs so slowly or there is something wrong with elastic agent?
Will be happy to provide all the necessary details.