# disable\_stream vs remove\_filter **URL:** \ **Category:** Zeek\ **Created:** [June 8, 2015, 2:01pm UTC](https://community.zeek.org/t/disable-stream-vs-remove-filter/3645 "2015-06-08T14:01:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Adam\_Hall](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Adam\_Hall](https://community.zeek.org/u/Adam_Hall)\ **Post date:** [June 8, 2015, 2:01pm UTC](https://community.zeek.org/t/disable-stream-vs-remove-filter/3645/1 "2015-06-08T14:01:53Z")
I am trying to figure out if there are any pro’s or con’s using disable\_stream vs remove\_filter. From the reading they appear as if they are interchangeable… but I want to make sure that one of them doesn’t have negative interplay. Background of the event is: I have Log::remove\_filter(Files::LOG,“default”); and created my own log where I only store certain mime\_types. I decided also that I wanted to remove other log files (weird, dpd, modbus, communication, known\_\*, PacketFilter) that aren’t being used when research is performed. I have commented out some in the local.bro but need to either disable\_stream or remove\_filter the rest. Also, I currently have 2.2 and 2.3 running. I am using 2.4 for testing and then figuring backwards compatibility. I am looking for: 1. Will one give me a performance gain over the other? 2. Will one cause problems for other calls being made (If I disable\_stream and something calls that stream will it break)? 3. If I disable a stream and later decide to add a new filter, will that work? I am still testing some of this, but any help would greatly appreciated! Thanks, Adam “RedLight” Hall ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 18, 2015, 5:10am UTC](https://community.zeek.org/t/disable-stream-vs-remove-filter/3645/2 "2015-06-18T05:10:17Z")
> 1) Will one give me a performance gain over the other? Probably nothing noticeable. > 2) Will one cause problems for other calls being made (If I disable\_stream and something calls that stream will it break)? Nope, no problems. > 3) If I disable a stream and later decide to add a new filter, will that work? I’m having trouble remembering, but logging settings may not all be changeable at runtime. I’m actually curious which settings are possible at runtime. I assume you were talking about changes during runtime?   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/disable-stream-vs-remove-filter/3645/3 "2022-05-06T15:42:45Z")
Closed on May 6, 2022, 3:42pm UTC