Understanding Time Semantics in Apache Flink: Processing Time, Event Time, and Ingestion Time

Big Data Path: a series of Flink tutorials are offered, including an introduction to Flink, the DataSet & DataStream APIs, cluster deployment, restart strategies, and distributed cache techniques.

Flink Introduction

Flink DataSet & DataStream API

Flink Cluster Deployment

Flink Restart Strategy

Flink Distributed Cache

1. Time Types

Event Time – the timestamp embedded in the event data.

Ingestion Time – the time when the event enters Flink, taken from the source’s system clock.

Processing Time – the machine’s system time when the event is processed.

2. Time Details

Below is a classic diagram illustrating the three concepts:

Processing Time

Processing Time refers to the system clock of the machine that processes the event. When a Flink job runs on Processing Time, all time‑based operations (such as windows) use this clock. For example, a one‑hour Processing Time window that starts at 09:15 will contain all events processed between 09:15 and 10:00.

Processing Time offers the best performance and lowest latency because it requires no coordination between the source and the processing nodes. However, in distributed or asynchronous environments it cannot guarantee deterministic results, as it is affected by event arrival delays and system interruptions.

Event Time

Event Time is the timestamp that indicates when the event actually occurred, typically carried within the event payload. Flink programs must define how to generate watermarks to track Event Time progress. Event Time yields consistent and deterministic results regardless of when events arrive, but it may introduce latency while waiting for out‑of‑order events.

For instance, an hourly Event Time window will include all records whose event timestamps fall within that hour, irrespective of their arrival order.

In practice, many real‑time Event Time jobs also use occasional Processing Time operations to ensure timely progress.

Ingestion Time

Ingestion Time is the moment an event enters Flink, assigned by the source operator using its current system time. It sits conceptually between Event Time and Processing Time: more predictable than Processing Time but simpler than Event Time because Flink automatically assigns timestamps and generates watermarks.

Unlike Event Time, Ingestion Time cannot handle out‑of‑order or late data, but it does not require the user to define watermark strategies.

For the original article and additional resources, click the link below.

Original article link – jump to view the source.