# Expensive if statement in Logstash config

**URL:** https://discuss.elastic.co/t/expensive-if-statement-in-logstash-config/47420
**Category:** Logstash
**Created:** [April 14, 2016, 5:44pm UTC](https://discuss.elastic.co/t/expensive-if-statement-in-logstash-config/47420 "2016-04-14T17:44:15Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 14, 2016, 5:44pm UTC](https://discuss.elastic.co/t/expensive-if-statement-in-logstash-config/47420/1 "2016-04-14T17:44:15Z")

</div>

Hi all,

I'm using Logstash 2.3.0 to receive netflow data from nProbe. There are some custom application ports that would be named as `Unknown` protocol, so I use if/else if in Logstash to check for destination port and rename the protocol to the right name

```auto
filter {
if [type] == "netflow" {       
        if [L4_DST_PORT] in [5601, 5602] {
            mutate { update => { "L7_PROTO_NAME" => "Kibana" } }        
        } else if [L4_DST_PORT] in [9200, 9201] {
            mutate { update => { "L7_PROTO_NAME" => "Elasticsearch" } }    
        } else if [L4_DST_PORT] in [5544, 5545] {
            mutate { update => { "L7_PROTO_NAME" => "Logstash" } }
        }
	}
}

```

The problem is that if I put this block in Logstash config, the throughput to ES drops from **800-1000 EPS** to **200 EPS** which is 4 to 5 times less without this **if** block. nProbe is not a factor in this throughput drop.

Is there any other more efficient ways to achieve this check and mutate task?

Thanks,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/expensive-if-statement-in-logstash-config/47420/2 "2017-07-06T05:02:11Z")

</div>