# Threshold Alerts with Delayed Logs - Verification

**URL:** <https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362>\
**Category:** Elastic Security\
**Created:** [July 13, 2023, 10:10pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362 "2023-07-13T22:10:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kbratt](https://avatars.discourse-cdn.com/v4/letter/k/ec9cab/32.png) [@kbratt](https://discuss.elastic.co/u/kbratt)\
**Post date:** [July 13, 2023, 10:10pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362/1 "2023-07-13T22:10:04Z")

</div>

I have set up Threshold Security Alerts that are running every 5 minutes and looking back an additional 1 minute..

We are working on fixing a performance issue where our Logs are delayed by up to 20 minutes at times.

Since our Logs can be delayed by up to 20 minutes, and my Threshold rules are running every 5 minutes, will my threshold rules not trigger during these times because by the time my logs are processed, they can be 20 minutes old already?

Thanks

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [July 24, 2023, 3:29pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362/2 "2023-07-24T15:29:20Z")

</div>

Hey @kbratt  
Welcome to Elastic community  
If logs delayed by 20m, with rule's interval 5m + 1m lookback time(6m in total), these events won't be queried, if their timestamp is 20m in past.  
There are 2 possible options:

1. Increase lookback time, so events with timestamp in past will be caught. In your case, if you anticipate 20m delay - 30m lookback time might be enough. But it won't guarantee that events will be processed, if delay would be 40m for example.
2. Use timestamp override option(preferable): [Create a detection rule | Elastic Security Solution [8.11] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-advanced-params). See option k:

> **Timestamp override** (optional): Select a source event timestamp field. When selected, the rule’s query uses the selected field, instead of the default `@timestamp` field, to search for alerts. This can help reduce missing alerts due to network or server outages. Specifically, if your ingest pipeline adds a timestamp when events are sent to Elasticsearch, this avoids missing alerts due to ingestion delays. However, if you know your data source has an inaccurate `@timestamp` value, it is recommended you select the **Do not use @timestamp as a fallback timestamp field** option to ignore the `@timestamp` field entirely.

Hope that will help to resolve the issue.  
Thanks, Vitalii

---

<div class="post-metadata">

**Author:** ![kbratt](https://avatars.discourse-cdn.com/v4/letter/k/ec9cab/32.png) [@kbratt](https://discuss.elastic.co/u/kbratt)\
**Post date:** [July 27, 2023, 3:53pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362/3 "2023-07-27T15:53:18Z")

</div>

Just what I needed, thanks @vitaliidm !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2023, 3:53pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362/4 "2023-08-24T15:53:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.