Use case is a Cloud, taking all audit/log data, wrapping in metadata, and then placing it in a location which then needs analytics available on.

Currently this is done for the control plane by just loading them directly into Elasticsearch. Increasing the availability for all users, the consideration is, does a pub/sub add anything that just throwing the data directly into an s3 like bucket (swift in our case).

I just assumed it did. Everyone does it. Scale, decoupling the sender from the receiver...

But... I mean, why? What's the point of an additional hop, and another thing to manage. If your source is already wrapping metadata, and perhaps putting it into a structure, what is the value of a pub/sub there? If you can load it to the pub/sub, you can load it to the s3 bucket in the same manner.