Measure late-arriving events

SELECT
  source,
  event_name,
  COUNT(*) AS events,
  AVG(date_part('second', received_at - timestamp_utc)) / 60.0
    AS average_delay_minutes,
  approx_percentile_cont(
    date_part('second', received_at - timestamp_utc) / 60.0,
    0.95
  ) AS p95_delay_minutes,
  SUM(CASE
    WHEN received_at - timestamp_utc > INTERVAL '15 minutes' THEN 1
    ELSE 0
  END) AS events_over_15_minutes
FROM ingestion_events
WHERE received_at >= now() - INTERVAL '24 hours'
  AND received_at >= timestamp_utc
GROUP BY source, event_name
HAVING COUNT(*) >= 20
ORDER BY p95_delay_minutes DESC;