There are many questions when facing the decision of how to create your data scheme for events,
whether you're using Elastic Search, Google's Big Query, Amazon's Redshift, Splunk and others.
For example:
1.Metrics vs Dimensions - what is truly the difference between those definitions?
2.Should all my data be in a single flat event and have multiple values or should each event have only 1 value or maybe a mix of those approaches?
My free opinion on theory: the data scheme should reflect the underlying business logic, then the tool should be selected to support the business logic and the data scheme.<p>My free meta opinion: Most projects don't require tools designed for the scale that the listed tools are designed for and because most organizations lack the institutional knowledge necessary to sort through the diverse failure modes in a tool chain built around these technologies these organizations will be better served by something simpler until such time as they grow to the point where experienced technical expertise in the technology can be hired...i.e. the knowledge dependency chain of tools designed to serve Google scale businesses are likely to be a rabbit hole for an individual developer.<p>Good luck.