I've seen some messages have a timestamp of like hours earlier in the json, and then the timestamp outside showing the processed time.
This should be instantly, and really a bad practice to have messages processed hours later after being generated.
Like this message https://graylog.miraheze.org/messages/graylog_95/738047a1-72a1-11eb-a4a5-0200001a24a4