# Best practice for adding tag in an inexpensive way?

**URL:** <https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321>\
**Category:** Logstash\
**Created:** [April 29, 2020, 7:17am UTC](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321 "2020-04-29T07:17:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![omersiar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omersiar/32/70536_2.png) [@omersiar](https://discuss.elastic.co/u/omersiar)\
**Post date:** [April 29, 2020, 7:17am UTC](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321/1 "2020-04-29T07:17:15Z")

</div>

Hello All,

Trying to understand structure of Logstash pipeline configuration, it seems almost every plugin (that are shipped by default) has some common functions like adding fields, removing tags, etc.

My question is what is the most inexpensive (in context of CPU cycle) way to use them in a pipeline configuration.

Is there any considerable difference between adding a tag with mutate filter or dissect filter? Are they loaded into memory even if I don't use them? If I used dissect plugin one time, should I continue to use it again to add a tag?

```auto
    input {
    }

    filter {
      # dissect scope
      dissect {
        # do dissecting
      }
      # then i need to check for conditions for additional tagging
      # then i'm using mutate for adding a tag ?
      # could not i use add_tag alone? inside filter scope? should i go with dissect again?
      mutate {
        add_tag => ["transactionEnded"]
      }
    }

    output {
    }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 29, 2020, 1:26pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321/2 "2020-04-29T13:26:24Z")

</div>

> [@omersiar](#):
>
> it seems almost every plugin (that are shipped by default) has some common functions like adding fields, removing tags, etc.

Yes, if a plugin successfully processes an event then it will "decorate" the event. That means it processes the options that are common to filters such as add\_field, add\_tag, remove\_field etc. Every filter uses a shared library function to do this, so the cost should be the same for every filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2020, 1:26pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-tag-in-an-inexpensive-way/230321/3 "2020-05-27T13:26:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.