# Is it possible to shorten this Logstash filter cascade?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-shorten-this-logstash-filter-cascade/153525>\
**Category:** Logstash\
**Created:** [October 23, 2018, 6:29am UTC](https://discuss.elastic.co/t/is-it-possible-to-shorten-this-logstash-filter-cascade/153525 "2018-10-23T06:29:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [October 23, 2018, 6:29am UTC](https://discuss.elastic.co/t/is-it-possible-to-shorten-this-logstash-filter-cascade/153525/1 "2018-10-23T06:29:55Z")

</div>

Hi,

i am using ELK GA 6.3.0. I read from Kafka and I have the below filter cascade;

```
filter {

	dissect {
		mapping => {
			"message" => "<%{timestamp}> <%{f2}> <%{f3}> <%{f4}> <%{f5}> <%{f6}> %{rest}"
		}
	}

	grok {
		match => {
			"rest" => "<%{NOTSPACE:f7}>\n <%{NOTSPACE:f8}: %{GREEDYDATA:f9}>"
		}
	}

	date {
		match => ["timestamp", "MMM dd, YYYY hh:mm:ss:SSS aa"]
		timezone => "UTC"
		target => "@timestamp"
	}

	mutate {
		remove_field => ["rest", "f4", "f5", "offset", "host", "@version", "input", "beat", "prospector", "fields", "timestamp"]
	}

}

```

What I am doing is removing some unwanted log entries + removing filebeat entries. Is it possible to do the same with less CPU impact, or can I do something in filebeat also, to achieve the same?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 6:35am UTC](https://discuss.elastic.co/t/is-it-possible-to-shorten-this-logstash-filter-cascade/153525/2 "2018-11-20T06:35:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.