ingest pipeline docs "ingest lag"

[philippkahr]

#1381 relates to this, we pulled this file out as it's standalone for better review

[github-actions]

🔍 Preview links for changed docs:

• manage-data/ingest/transform-enrich/ingest-lag.md

🔔 The preview site may take up to 3 minutes to finish building. These links will become live once it completes.

[stefnestor]

Since @timestamp is usually overrode to data source timestamp, my team usually recommends event.created instead which is when it hits its first Elastic product (although I believe exception is Logstash pipelines don't qualify as pipeline in that doc and don't induce the field although Agent+Elasticsearch would.

[philippkahr]

Yes, but event.created is not created automatically in Elastic Agent anymore, thus you need to add this to all the integrations manually. We can add a recommendation for it.

[philippkahr]

I rewrote it a bit and added the code needed to add the event.created.

[theletterf]

First review pass.

[theletterf]

You should edit https://www.elastic.co/docs/manage-data/ingest/transform-enrich to add the appropriate section for the new doc.

[philippkahr]

No idea what do you mean by that to be honest. Can you take care of that for me?

[theletterf]

You'll see that in https://www.elastic.co/docs/manage-data/ingest/transform-enrich each of the subpages is introduced. Not mandatory, but might worth doing it for this one as well. A paragraph could suffice.