2

I can see both "ingestionTime" and "timestamp" in my AWS VPC flow logs. The timestamp seems to change more frequently than the ingestionTime, but neither seems to tell me very much.

The docs here don't say much either. I would post an image, but I don't have the reputation yet.

makansij
  • 265
  • 1
  • 5
  • 12

1 Answers1

0

I believe the Timestamp is the time at which the log event was generated, and IngestionTime is the timestamp at which the event was received by the AWS log shipper, i.e. when AWS first became aware of that log entry.

Mike Ryan
  • 288
  • 2
  • 11