Adding event.ingested and lag calculations to Winlogbeat events
Create an Ingest Pipeline that will add four fields:
event.ingested
- Time when the event was processed by Elasticsearch.event.lag.read
- Time difference in milliseconds between@timestamp
andevent.created
. This measures how long it took for Winlogbeat read the event from the event log (for WEC this includes the delivery time from forwarder to collector).event.lag.ingest
- Time difference in milliseconds betweenevent.created
andevent.ingested
. This measures the time between Winlogbeat reading the event (time when it "created" the document) to when it was written to Elasticsearch.