# Processing sequence for logstash - filter - mutate

**URL:** https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425
**Category:** Logstash
**Created:** [April 4, 2019, 1:43pm UTC](https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425 "2019-04-04T13:43:26Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![olatunde.tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde.tokun/32/110546_2.png) [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)
#### Post date: [April 4, 2019, 1:43pm UTC](https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425/1 "2019-04-04T13:43:26Z")

</div>

Hi there,

The filter mutate has a processing order according to the docs [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order).

I would like to know the order within the `rename` itself.

Scenario: I am trying to [ecs](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) Windows Security Logs with logstash-mutate.

There are over \>300 fields in this index which would typically mean \>300 rename mutations in logstash. However some events are seen more often than some others, does it provide any improved performance to have the more common fields at the top of the sequence (re:Auditd rules).  
Running tests in my lab doesnt show any considerable perf issues but im curious to know how logstash functions behaves behind the hood before deployment into production or if there are any ways to optimize it.

There might be a smarter way of doing this, any suggestions are welcome.

Thanks

```auto
rename => { "[event_data][LocalAddresses]" => "[event_data][local][addresses]" }
rename => { "[event_data][LocalKeyModPort]" => "[event_data][local][key_mod_port]" }
rename => { "[event_data][LocalMMPrincipalName]" => "[event_data][local][mm_principal_name]" }
rename => { "[event_data][LocalOnlyMapped]" => "[event_data][local][only_mapped]" }
rename => { "[event_data][LocalPorts]" => "[event_data][local][ports]" }
rename => { "[event_data][LocationInformation]" => "[event_data][location_information]" }
rename => { "[event_data][LockoutDuration]" => "[event_data][lockout_duration]" }
rename => { "[event_data][LockoutObservationWindow]" => "[event_data][lockout_observation_window]" }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2019, 1:43pm UTC](https://discuss.elastic.co/t/processing-sequence-for-logstash-filter-mutate/175425/2 "2019-05-02T13:43:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.