# Event.ingested huge time difference **URL:** \ **Category:** Elastic Security\ **Created:** [May 22, 2023, 6:47am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975 "2023-05-22T06:47:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Post date:** [May 22, 2023, 6:47am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/1 "2023-05-22T06:47:27Z")
Hello All, While investigating on an event I noticed there was a huge difference between event.created and event.ingested which created a confusion on the real event time. Later digging in docs resulted event.ingested: timestamp when an event arrived in the central data store. This is different from @timestamp, which is when the event originally occurred. It’s also different from event.created, which is meant to capture the first time an agent saw the event. Now how do I prove that why elasticsearch is ingesting logs so slowly or there is something wrong with elastic agent? Will be happy to provide all the necessary details. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c563eb4e4c864ffe8d31421413fc432b6e89fafb.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 22, 2023, 8:46am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/2 "2023-05-22T08:46:06Z")
The lag seems very, very long. Is this something you see consistently for this type of event? Which timezone are you in? Is it possible this could be a timezone issue? ---
**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Post date:** [May 22, 2023, 10:38am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/3 "2023-05-22T10:38:02Z")
No, it isn't time zone issue I crosschecked the NTP. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 22, 2023, 10:42am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/4 "2023-05-22T10:42:29Z")
It could be a timezone issue based on how the timestamps are parsed even if NTP is OK. Please answer the questions I asked. ---
**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Post date:** [May 22, 2023, 10:53am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/5 "2023-05-22T10:53:30Z")
I didn't noticed it eariler but checking now it looks like there is at least a time difference of 2-3 hours for every event. Timezone:- IST. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 22, 2023, 11:02am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/6 "2023-05-22T11:02:21Z")
How are you ingesting data? What does the flow of these events look like? ---
**Author:** ![AnkurYogi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankuryogi/32/121279_2.png) [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Post date:** [May 22, 2023, 11:06am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/7 "2023-05-22T11:06:23Z")
It's the basic architecture. ELK and fleet on a single host nothing fancy. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 19, 2023, 11:07am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975/8 "2023-06-19T11:07:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.