timeout is now based on event creation timestamp and not event @timestamp