# Is logstash right choice for this?

**URL:** https://discuss.elastic.co/t/is-logstash-right-choice-for-this/200280
**Category:** Logstash
**Created:** [September 19, 2019, 5:29pm UTC](https://discuss.elastic.co/t/is-logstash-right-choice-for-this/200280 "2019-09-19T17:29:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![plexcellmedia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/plexcellmedia/32/54536_2.png) [@plexcellmedia](https://discuss.elastic.co/u/plexcellmedia)
#### Post date: [September 19, 2019, 5:29pm UTC](https://discuss.elastic.co/t/is-logstash-right-choice-for-this/200280/1 "2019-09-19T17:29:27Z")

</div>

Hey,

I'm having hard time here to go with right choice. I'm not sure if logstash is right way to go, hope you guys can help me out a bit.

So, currently all our user tracking data is sent to elasticsearch directly which might not be best option, as documents get updated multiple times per second at worst.

We got data coming in and it gets processed to at few different formats.

**Example 1: User event data**

 ![log1](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77dfab82125f1469d521eb0980fad2da1b9676c1.png)

Example 2: Page event data

 ![log2](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d5e2cfa33a9bfab6c5a3e202e444f141b152e76.png)

Would that kind of custom data processing be possible with logstash? It needs to update specific documents nested array data when needed.

This is what I have thought of:

1. Send logs to stackdriver / google storage bucket
2. Process logs with logstash to elasticsearch

or

1. Send logs to stackdriver / google storage bucket
2. Process logs with logstash to gzip files and send to google storage bucket
3. Add reference to gzip file in elasticsearch

Or should I have different approach?

Help appreciated.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 17, 2019, 5:29pm UTC](https://discuss.elastic.co/t/is-logstash-right-choice-for-this/200280/2 "2019-10-17T17:29:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
