Enriching Telemetry Events
Also available as:
PDF

Unified Topology Output

The timestamp output from the unified topology differs from the timestamp output from the split-join topology because the unified toplogy does not have split and join bolts.

The timestamp output from the unified topology will be similar to the following:
Adapter timestamps
"adapter:geoadapter:begin:ts": "1542882553866",
  "adapter:geoadapter:end:ts": "1542882553866",
  "adapter:threatinteladapter:begin:ts": "1542882553869",
  "adapter:threatinteladapter:end:ts": "1542882553870",
  "adapter:hostfromjsonlistadapter:begin:ts": "1542882553866",
  "adapter:hostfromjsonlistadapter:end:ts": "1542882553866"
Enrichment bolt timestamps
"parallelenricher:enrich:begin:ts": "1542882553869",
  "parallelenricher:enrich:end:ts": "1542882553870",
  "parallelenricher:splitter:begin:ts": "1542882553869",
  "parallelenricher:splitter:end:ts": "1542882553869"