Comparison
Event timevsIngestion time
Event time
the phone was in a tunnel, so the tap happened at 14:02 and your job saw it at 16:40, and the hourly chart has to put it at 14:00.
The moment the thing actually happened, carried on the record itself. Every result that is supposed to be stable — yesterday's totals, an hourly chart, a session length — has to be computed on event time, because processing time changes if you re-run the job. It is also the harder clock: it arrives out of order, it can be arbitrarily late, and it is only as trustworthy as the device that stamped it.
Full entry →Ingestion time
the record has no usable timestamp of its own, so you stamp it as it enters the log and everything downstream agrees on that.
The moment a record entered your system, assigned once at the boundary. It sits between the other two clocks: unlike processing time it does not move when you re-run, and unlike event time it is under your control and monotonic within a partition. It is the pragmatic fallback for sources that send no timestamp or send a dishonest one, and the honest thing to do is name the column so nobody later mistakes it for when the thing happened.
Full entry →