What does ingestion time mean in CloudWatch

Question

In the structure of an event of Cloudwatch :

'events': [
        {
            'logStreamName': 'string',
            'timestamp': 123,
            'message': 'string',
            'ingestionTime': 123,
            'eventId': 'string'
        },
    ]

What does ingestionTime mean ?

In this doc they are saying :

ingestionTime

The time the event was ingested.

Which I find still unclear.

score 22 · Accepted Answer · answered Jan 13 '17 at 12:03

22

There are two timestamp fields, here.

The timestamp is the time the event was said to have occurred, according to the message that was sent to CloudWatch.

The ingestionTime is the time CloudWatch actually received the message about the event.

The difference between the two -- assuming all clocks are accurate -- is the delay between when the event occurred and when CloudWatch received and "ingested" (was fed, ate, consumed) the message about the event.

answered Jan 13 '17 at 12:03

Michael - sqlbot

169,571
25
353
427

Is this timestamp field is calculated from the time which is logged in the message which is sent to the cloud watch? – Shan Chathusanda Jayathilaka May 22 '20 at 04:57
3

trust aws to add a totally useless feature to their generally unusable logging system – bharal Aug 08 '20 at 15:58

score 4 · Answer 2 · answered Jun 19 '19 at 22:59

According to my own investigations it looks like lastEventTimestamp is time of last event received by CloudWatch, however its update is slightly delayed, according to the documentation:

The lastEventTime value updates on an eventual consistency basis. It typically updates in less than an hour from ingestion, but may take longer in some rare situations.

On the other hand, lastIngestionTime shows the indicated timestamp of last event received to the stream. And this one gets updated immediately after the event was received by CloudWatch service.

So if you are looking for timestamp of most recent event in the stream, you are probably looking for lastIngestionTime.

What does ingestion time mean in CloudWatch

2 Answers2