In my case, the relationship between input and output events is that output events are generated out of some rules based on input events. Essentially, output events correspond to specific patterns / sequences of input events. You can think of output events as detecting certain anomalies or abnormal conditions. So I guess we are more in the second case you mention where the Flink TM can be regarded as a generator and hence using the processing time makes sense.
Indeed, I am using both the processing time and the event time watermark value at the moment of generating the output events. I think both convey useful information. In particular, the processing time looks as the logical timestamp for the output events. However, although that would be an exception, it might also happen that my flink app is processing old data at some point. That is why I am also adding another timestamp with the current event-time watermark value. This allows the consumer of the output events to detect whether the output event corresponds to old data or not (by comparing the difference between the processing time and event time timestamps, which should in normal conditions be close to each other, except when processing old data). In the case of using both, what naming would you use for the two fields? Something along the lines of event_time and processing_time seems to leak implementation details of my app to the external services... -- Sent from: http://apache-flink-user-mailing-list-archive.2336050.n4.nabble.com/
