event.created is described as the time when the event was first read by an agent or by a pipeline. In a distributed setup however that means that information is lost about the time taken to process an event at the various stages.

Would it be possible to add new fields to event to keep that information? For example, event.processed can hold the time when e.g. logstash (the last one in a chain or maybe an array) actually processes the event, and event.ingested when an ingest pipeline handles it.

Does this make sense?