# Performance grok vs mutate on finding message level
**URL:** https://discuss.elastic.co/t/performance-grok-vs-mutate-on-finding-message-level/29259
**Category:** Logstash
**Created:** [September 14, 2015, 3:22pm UTC](https://discuss.elastic.co/t/performance-grok-vs-mutate-on-finding-message-level/29259 "2015-09-14T15:22:24Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)
#### Post date: [September 14, 2015, 3:22pm UTC](https://discuss.elastic.co/t/performance-grok-vs-mutate-on-finding-message-level/29259/1 "2015-09-14T15:22:24Z")
I have a log that is filled with nonsense data. So I am keeping it simple with a grok match only date than greedydata everything else. Halfway into the message I am given a message level i.e. info, error, ... that I need to track down.
So my question is what is better for performance grok and match each of these nonsense data that I do not know how to categorize
OR:
just use conditions and check if message contains error, info, debug
I ask because I have heard that grok takes a lot of resources but these conditionals may use just as much.
Thanks,
M
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 15, 2015, 9:56pm UTC](https://discuss.elastic.co/t/performance-grok-vs-mutate-on-finding-message-level/29259/2 "2015-09-15T21:56:41Z")
This is really something you'd want to test on your own data.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/performance-grok-vs-mutate-on-finding-message-level/29259/3 "2017-07-06T05:29:03Z")