# Should i merge a stream of variables into a single event to make elastic work more efficiently **URL:** \ **Category:** Elasticsearch\ **Created:** [March 28, 2018, 6:13am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860 "2018-03-28T06:13:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sapoku](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sapoku](https://discuss.elastic.co/u/Sapoku)\ **Post date:** [March 28, 2018, 6:13am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/1 "2018-03-28T06:13:50Z")
I have a system that streams very 1 minute a series of values regarding its service to Logstash. So basically, it streams about 50-60 variables on each event. With the variables there is also sent a transaction ID, so group all the variables into a single event in logstash should not be a problem. The question is if this is something usefull to do. Will this help save space in elastic or improve search time? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 6:30am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/2 "2018-03-28T06:30:40Z")
I'd probably look at the aggregate filter in logstash. ---
**Author:** ![Sapoku](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sapoku](https://discuss.elastic.co/u/Sapoku)\ **Post date:** [March 28, 2018, 7:08am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/3 "2018-03-28T07:08:20Z")
Thanks for the response. But my question is related to understand if the effort is useful. If it will produce any positive impacts on either disk consumption or elastic query performance. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 28, 2018, 9:27am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/4 "2018-03-28T09:27:48Z")
Share some examples and you might be able to tell. I mean that it depends on: - What you are collecting - What the users will search for (what kind of document they want) - What are the fields needed to search for those documents. ---
**Author:** ![Sapoku](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sapoku](https://discuss.elastic.co/u/Sapoku)\ **Post date:** [March 28, 2018, 5:42pm UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/5 "2018-03-28T17:42:06Z")
App Statistics Like: Number of TCP4-Querys, TCP4-Answers, TCP-Error. Number of TCP6-Querys, TCP6-Answers, TCP6-Error. CPU Time Consumed by app. Memory Consumption by App. This is not directly queried by the users. They are queried by Kibana to build monitoring dashboards. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 3, 2018, 7:56am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/6 "2018-04-03T07:56:21Z")
Don't you have actual Json documents ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2018, 7:56am UTC](https://discuss.elastic.co/t/should-i-merge-a-stream-of-variables-into-a-single-event-to-make-elastic-work-more-efficiently/125860/7 "2018-05-01T07:56:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.