# Dissect vs. GROK + other tweak questions
**URL:** https://discuss.elastic.co/t/dissect-vs-grok-other-tweak-questions/124677
**Category:** Logstash
**Created:** [March 20, 2018, 4:08am UTC](https://discuss.elastic.co/t/dissect-vs-grok-other-tweak-questions/124677 "2018-03-20T04:08:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@kabilan](https://discuss.elastic.co/u/kabilan)
#### Post date: [March 20, 2018, 4:08am UTC](https://discuss.elastic.co/t/dissect-vs-grok-other-tweak-questions/124677/1 "2018-03-20T04:08:32Z")
I am looking to migrate many of parsers away from grokking and towards dissect when feasible. i had a question pertaining to performance
%{header}-%{timestamp}-%{payload}
-Dissect logs into 3 segments
-Timestamp will be extracted and mutated to target @timestamp
-Conditionals to dissect payload-segment accordingly into sub-segments
filter {
[dissect] (mapping -\> head-timestamp-payload)
if [dissect]
else if [dissect]
else [dissect]
[/dissect]
[mutate \> tempdate]
[date] [tempdate \> @timestamp]
[mutate \> remove tempdate]
}
filter {
[dissect] (mapping -\> head-timestamp-payload)
if [dissect]
[mutate \> tempdate]
[date] [tempdate \> @timestamp]
[mutate \> remove tempdate]
else if [dissect]
[mutate \> tempdate]
[date] [tempdate \> @timestamp]
[mutate \> remove tempdate]
else [dissect]
[mutate \> tempdate]
[date] [tempdate \> @timestamp]
[mutate \> remove tempdate]
[/dissect]
this may be a dumb question, but which way is optimal?
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [March 20, 2018, 5:57am UTC](https://discuss.elastic.co/t/dissect-vs-grok-other-tweak-questions/124677/2 "2018-03-20T05:57:38Z")
I'm not entirely sure I'm grokking your pseudo-configs; if you're asking whether you have to repeat yourself to get more efficiency, the answer is usually "no" (there are some rare cases where filters have constrained resources where adding more instances may mitigate bottlenecks, but most filters are stateless and will not benefit).
When I do a phased dissect, I typically do subsequent phases if the phase before it succeeded:
```auto
# ...
filter {
dissect {
# pulls out timestamp, others
# bits that will be further processed should be
# bound to `@metadata` fields, which by default
# won't be persisted in outputs
}
if "_dissectfailure" not in [tags] {
# only do this work if the first parse didn't fail
date {
# ...
}
# further work on the bits we already extracted
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2018, 5:57am UTC](https://discuss.elastic.co/t/dissect-vs-grok-other-tweak-questions/124677/3 "2018-04-17T05:57:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.