I can see both "ingestionTime" and "timestamp" in my AWS VPC flow logs. The timestamp seems to change more frequently than the ingestionTime, but neither seems to tell me very much.

The docs here don't say much either. I would post an image, but I don't have the reputation yet.

  • Perhaps this question is too early since flow logs only came out a few months ago?? – simple Aug 9 '15 at 17:50

I believe the Timestamp is the time at which the log event was generated, and IngestionTime is the timestamp at which the event was received by the AWS log shipper, i.e. when AWS first became aware of that log entry.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.