Description of problem:

Currently the way Vector handles updates to events in the eventrouter pipeline is that for update it will use the creationTimestamp as the timestamp of the log event. The problem with this is that on a production environment the API Server will issue these update event for event's who have been created more than 2 weeks ago. This makes it so that when the log event reaches Loki it will be rejected with "greater_than_max_sample_age", this is not a re-try able error but it will keep happening as the API Server will continue to update older events.

Version-Release number of selected component (if applicable): 6.2

How reproducible: We were able to do it in 6.2 but in 6.3 it seems to be gone...

Steps to Reproduce:

3. ...

Actual results:

Expected results:

Additional info: