Dear all,
I have just one grok filter in my logstash and it horrible utilizes CPU up to 1600%
Could you, please help me to detect bottleneck in my filter and fix it?
Thank you in advance.
That's my filter:
filter {
if [fields][type] == "test_st" {
grok {
match => { "message" => ["(?<action_date>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.(?\d{0,3})) [(?<session_id>%{WORD:username}
?[^]])] .HOST[ = ]%{HOSTNAME:db_name}((.|\n))).[\s\n](?<sql_command>[(\w+] ((.|\n)))[\s\n]{(?<d_time>[^}])}",
"(?<action_date>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.(?\d{0,3})) [(?<session_id>%{WORD:username}?[^]])] .@(?<db_name>.)[\s\n](?<sql_command>[(\w+] ((.|\n)))[\s\n]{(?<d_time>[^}]*)}"]}
}
date {
match => ["action_date","yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}
}
else if [fields][type] == "test_log" {
grok {
match => { "message" => ["%{DATESTAMP:action_date}\s+[%{LOGLEVEL:log_level}]\s+{(?<app_log>[^}])}\s+[(?<session_id>%{WORD:username}?[^]])]\s+-\s+(?<command_response>(((.|\n))?(?=^\d[^\d])((.|\n)))|((.|\n))*)"]}
}
date {
match => ["action_date","dd-MM-yyyy HH:mm:ss"]
target => "@timestamp"
}
}
else if [fields][type] == "test_d" {
grok {
match => { "message" => ["%{DATESTAMP:action_date} [%{LOGLEVEL:log_level}] {(?<app_log>[^}])} [(?<session_id>%{WORD:username}?[^]])] -.: (?.),User:.,Start date2:(?<start_date>.),End date1:(?<end_date>.*),"]}
}
date {
match => ["action_date","dd-MM-yyyy HH:mm:ss"]
target => "@timestamp"
}
}
else if [fields][type] == "test_error" {
grok {
match => { "message" => ["%{DATESTAMP:action_date} [%{LOGLEVEL:log_level}] {(?<app_log>[^}])} [(?<session_id>%{WORD:username}?[^]])] - [.] (?((.|\n)))"]}
}
date {
match => ["action_date","dd-MM-yyyy HH:mm:ss"]
target => "@timestamp"
}
}
else if [fields][type] == "robin" {
grok {
match => { "message" => ["(?<action_date>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME},(?<milliseconds>\d{0,3}))\s*%{LOGLEVEL:log_level}\s\[(?<session_id>(?<sms_id>\d+)?-(?<msisdn>\d+)?-[^\]]*)\]\s*\((?<app_log>[^\)]*)\)\s*(?<command_response>((.|\n))*)"]}
}
date {
match => ["action_date","yyyy-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
}
}
}