Doing the calculation at the source has the benefit that it may scale better as you do not need all related events to pass through a single Logstash instance/thread for the calculation, so unless you know your volumes are always going to be low it may be worth considering.