When does @timestamp get added?

The @timestamp is added as the event is created just before the event is added to the queue. Technically speaking it is the codec in the input that creates the event and puts it in to the queue.
Once it is set it is not changed - only the date or ruby filters can do that.

Do you have a size limit on the PQ? If the PQ fills up then the codec and Input will block waiting for access. While this blocking happens no polling takes place.

Back-pressure is the only thing I can think of.

1 Like