# How to optimise/cleanup config with multiple mutations?

**URL:** https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464
**Category:** Logstash
**Created:** [August 4, 2021, 5:32pm UTC](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464 "2021-08-04T17:32:27Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![GitSpree23](https://avatars.discourse-cdn.com/v4/letter/g/65b543/32.png) [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)
#### Post date: [August 4, 2021, 5:32pm UTC](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464/1 "2021-08-04T17:32:27Z")

</div>

There are a lot of new field creations, renames, and removals in my filter plugin. And if, for example, I try to club the renames together, the mutations don't get executed correctly and i end up with only half the mutations applied.

This is my filter plugin:

```auto
filter {
  json {
    source => "message"
    target => "message_deserialized"
  }

  ruby {
    init => "require 'base64'
             require 'zlib'
             require 'stringio'"
    code => 'event.set("[message_deserialized][message_json_decoded]", Zlib::GzipReader.new(StringIO.new(Base64.decode64(event.get("[message_deserialized][message_json]")))).read)' }

  json {
    source => "[message_deserialized][message_json_decoded]"
    target => "[message_deserialized][message_json_decoded_deserialized]"
  }

  mutate {
    remove_field => ["message", "[message_deserialized][message_json]", "[message_deserialized][message_json_decoded]" ]
  }

  mutate {
    rename => { "[message_deserialized][message_json_decoded_deserialized]" => "[message_deserialized][message_json]" }
  }

  mutate {
    rename => { "message_deserialized" => "message" }
  }

  split {
    field => "[message][message_json]"
  }
}

```

How to reduce LoC and optimise the transformations to execute faster?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 4, 2021, 8:23pm UTC](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464/2 "2021-08-04T20:23:50Z")

</div>

> [@GitSpree23](#):
>
> And if, for example, I try to club the renames together, the mutations don't get executed correctly and i end up with only half the mutations applied.

You have to use multiple mutate filters if you need to constrain the order. That applies to both the order in which options execute (see [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order) and [here](https://github.com/elastic/logstash/blob/c679de1542dc45f0174797858fc181e116e3cc1e/logstash-core/lib/logstash/filters/base.rb#L197)), as well as the order of entries in an option.

If you do

```
mutate {
    rename {
        "[foo][bar]" => "a"
        "[foo]" => "b"
   }
}

```

does the entry within [foo] get renamed before [foo] itself moves? The answer is that it used to, but in (I think) 7.12 and newer the order is (sometimes?) switched, so that when it tries to rename [foo][bar] it no longer exists.

I cannot conceive that the performance impact of having multiple filter will be significant.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2021, 8:24pm UTC](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464/3 "2021-09-01T20:24:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
