Are you saying that if everything became an event, its easier to correlate because the event is more free form and it's easier to add custom metadata? In theor

Are you saying that if everything became an event, its easier to correlate because the event is more free form and it's easier to add custom metadata? In theory, I agree with you. But you can't eliminate 'joins' all together, IMO, because it's not practical to know beforehand what context will be useful.