# ElasticSearch Crashes after Grok test in Kibana 7.4.0

**URL:** <https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123>\
**Category:** Elasticsearch\
**Created:** [October 10, 2019, 10:56pm UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123 "2019-10-10T22:56:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\
**Post date:** [October 10, 2019, 10:56pm UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123/1 "2019-10-10T22:56:05Z")

</div>

Playing around in our test cluster I think I may have uncovered an odd bug.

I was testing some Grok expressions in Kibana Dev Tools and was able to crash a 3 node cluster with a simple pattern test. Can anyone else validate this?

Go to Dev Tools, Grok Expression and enter this for the Sample Data:  
[http://www.mycrazymadeupurl.com/weirdurlpath](http://www.mycrazymadeupurl.com/weirdurlpath)?

Then enter this for the Grok Pattern  
(?\<attack.term.hit\>((?i)(varchar)(?i)|(?i)()(?i)|(?i)(cast())(?i)))

Running 7.4.0 For Kibana, Elastic, and LogStash (but not doing anything with LogStash in this example)

Probably something weird in my environment but curious if this crashes others. DO NOT TRY THIS IN A PRODUCTION CLUSTER!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2019, 11:06pm UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-grok-test-in-kibana-7-4-0/203123/2 "2019-11-07T23:06:00Z")

</div>

Closed on November 7, 2019, 11:06pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.