# Whats the difference as well as the preferred way to?

**URL:** <https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415>\
**Category:** Logstash\
**Created:** [August 10, 2020, 2:20pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415 "2020-08-10T14:20:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [August 10, 2020, 2:20pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415/1 "2020-08-10T14:20:12Z")

</div>

I am trying to update my Logstash configs to be the best they can be.

If I am looking for a string within a field, which way is the "best" way, in terms of performance?

**Option #1**  
`if [message] =~ /(?i)(QNAME)/ {`

**Option #2**  
`if "QNAME" in [message] {`

Follow up question for **Option #2**. Does it care about case sensitivity ?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 10, 2020, 2:44pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415/2 "2020-08-10T14:44:07Z")

</div>

`... in ...` is case-sensitive and Logstash translates it into something like `...include?(...)` and therefore the performance for a case-sensitive search for a sub string would be better this way: [http://www.mervine.net/ruby-methods-vs-regex](http://www.mervine.net/ruby-methods-vs-regex)  
But if you need it to be case-insensitive I'd use a regex. (Another option would be to use Ruby and compare the strings with `....upcase.include?(...)`, but I'd consider this to be pretty laborious and confusing in the context of a Logstash config file.)

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [August 10, 2020, 2:55pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415/3 "2020-08-10T14:55:36Z")

</div>

Yea I will pass on Ruby.

Regex is how I had been doing it, but if I am looking for a specific string, in a specific case, I use the ..in.. method. But I figured I needed to get every check to be standardized. It's rough across 45 sites and nearly 200 ingest points. But I gotta get it done.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2020, 2:55pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415/4 "2020-09-07T14:55:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.