Query performance question: Using SQL transformations to convert a field to a timestamp data type vs. using _event_time


If a sql transformation uses CAST(field1 AS TIMESTAMP), will that have the same perf as using _event_time? The context is I have a query that’s almost 2 seconds using PARSE_TIMESTAMP_ISO8601, however, with _event_time the query performance 300ms.

Using _event_time would be faster in general as it is indexed. You can read more _event_time. You can overwrite the _event_time field when a document is being inserted/ingested.