Adding event.ingested and lag calculations to Winlogbeat events
Create an Ingest Pipeline that will add four fields:
event.ingested- Time when the event was processed by Elasticsearch.
event.lag.read- Time difference in milliseconds between
event.created. This measures how long it took for Winlogbeat read the event from the event log (for WEC this includes the delivery time from forwarder to collector).
event.lag.ingest- Time difference in milliseconds between
event.ingested. This measures the time between Winlogbeat reading the event (time when it "created" the document) to when it was written to Elasticsearch.