# Can ES be used for this kind of use case?

**URL:** <https://discuss.elastic.co/t/can-es-be-used-for-this-kind-of-use-case/138350>\
**Category:** Elasticsearch\
**Created:** [July 3, 2018, 10:03am UTC](https://discuss.elastic.co/t/can-es-be-used-for-this-kind-of-use-case/138350 "2018-07-03T10:03:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anand\_dubey](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anand\_dubey](https://discuss.elastic.co/u/anand_dubey)\
**Post date:** [July 3, 2018, 10:03am UTC](https://discuss.elastic.co/t/can-es-be-used-for-this-kind-of-use-case/138350/1 "2018-07-03T10:03:37Z")

</div>

We are planning to store real time event based data from various systems in ES, such that a set of events has dependency on each other. Please find example below:

## set of events

1st event {"id":"1", "f1":"123", "f2":"abc"}  
2nd event {"id":"2", "f3":"123", "f4":"xyz"} \<-- 2nd event is related to 1st event by value "123" (like a foreign key)  
3rd event {"id":"3", "f5":"xyz", "f6":"def"} \<-- 3rd event is related to 2nd event by value "xyz" (like a foreign key)

Our aim is to use these set of events to create a unique field across the set like below:  
after 1st event is processed  
{"id":"1", "f1":"123", "f2":"abc", "UID"="123"}

after 2st event is processed  
{"id":"1", "f1":"123", "f2":"abc", "UID"="123xyz"}  
{"id":"2", "f3":"123", "f4":"xyz", "UID"="123xyz"}

after 3st event is processed  
{"id":"1", "f1":"123", "f2":"abc", "UID"="123xyzdef"}  
{"id":"2", "f3":"123", "f4":"xyz", "UID"="123xyzdef"}  
{"id":"3", "f5":"xyz", "f6":"def", "UID"="123xyzdef"}

If we store the events in denormalized form or using parent child we will need to query ES before indexing the data in real time which will be very expensive.  
What can be the best way to go ahead with this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 10:03am UTC](https://discuss.elastic.co/t/can-es-be-used-for-this-kind-of-use-case/138350/2 "2018-07-31T10:03:47Z")

</div>

Closed on July 31, 2018, 10:03am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.