# Which is more efficient? KV, Dissect, Split, Grok
**URL:** https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789
**Category:** Logstash
**Created:** [February 9, 2021, 5:46pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789 "2021-02-09T17:46:18Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 5:46pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789/1 "2021-02-09T17:46:19Z")
Hi all,
As there are many ways to achive similar goal using logstash filters, would like to discuss and compare between _KV_, _Dissect_, _Split_, and _Grok_, which is a better way of handling data?
**Scenario 1:**
Mapping & Parsing logs with consistent delimiter
**Better:** _KV_
**Scenario 2:**
Mapping & Parsing logs with inconsistent pattern
**Better:** If both _Dissect_ and _Grok_ able to achieve the same goal, should we use _Dissect_ or _Grok_ for a more efficient / effective parsing?
**Scenario 3:**
Extracting data from field (For example extracting server name fqdn, or domain from a url)
**Better:** If both _Split_ / _Grok_ able to achive the goal, which will be more efficient to use?
Anyone have any example would be nice to discuss together too!!
Thanks!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 9, 2021, 6:52pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789/2 "2021-02-09T18:52:10Z")
In general I would say that the extreme flexibility of grok comes at a price compared to dissect.
That said, unless you are processing very large volumes of data it does not make sense to choose a filter based on cost. Instead choose whichever one is simpler. If you are processing huge volumes of data, to the point where cost is a significant factor, then benchmark each option and measure the cost.
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 6:55pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789/3 "2021-02-09T18:55:38Z")
Thanks for the great tips Badger!! It make sense that if cost isn't a big factor we should choose whichever simpler!!
Kudos!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2021, 6:56pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789/4 "2021-03-09T18:56:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.