# Grock Parsing high CPU not stopping **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2019, 3:04pm UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682 "2019-05-24T15:04:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Antoine.E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine.e/32/41348_2.png) [@Antoine.E](https://discuss.elastic.co/u/Antoine.E)\ **Post date:** [May 24, 2019, 3:04pm UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/1 "2019-05-24T15:04:45Z")
SLES 12 SP3 ELK 7.1.0 Hello everybody, I have a problem with my Logstash, whenever i create a grock pattern for a certain part of my log, my CPU keep going up and stopping there. It look like the thread with the grock is freezed : > [2019-05-24T15:25:33,507][WARN][org.logstash.execution.ShutdownWatcherExt] {"inflight\_count"=\>0, "stalling\_threads\_info"=\>{["LogStash::Filters::Grok", {"match"=\>{"message"=\>"%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601\_TIMEZONE}? %{IPV4:IP} %{UNIXPATH:Chemin} %{TIMESTAMP\_ISO8601:logTime} %{LOGLEVEL:Loglevel} %{WORD:Domain}\\%{WORD:user} %{GREEDYDATA:AppLog}"}, "id"=\>"3f4d487 ba4a68ee9d37bc51493bb156a295dee3894b8dcf78137ecfb25ab1f9d"}]=\>[{"thread\_id"=\>25, "name"=\>"[main]\>worker0", "current\_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182:in `match '"}, {"thread_id"=\>26, "name"=\>"[main]\>worker1", "current_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182:in `match'"}, {"thread\_id"=\>28, "name"=\>"[main]\>worker3", "current\_ call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182:in `match'"}, {"thread_id"=\>29, "name"=\>"[main]\>worker4", "current_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11 .5/lib/grok-pure.rb:182:in `match'"}, {"thread\_id"=\>30, "name"=\>"[main]\>worker5", "current\_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182:in `match'"}]}} The filter that I try to match is : > %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601\_TIMEZONE}? %{IPV4:IP} %{UNIXPATH:Chemin} %{TIMESTAMP\_ISO8601:logTime} %{LOGLEVEL:Loglevel} %{WORD:Domain}\%{WORD:user} %{GREEDYDATA:AppLog} An exemple of log would be : > 2019-05-24T15:05:14.957392+02:00 10.254.177.1 /LM/W3SVC/1/ROOT/WS\_PCIDSS2-1-132031733574297090: 2019-05-24 15:05:14,040 DEBUG Domain\User VMTESTTOTO DCC/Action : CNXname = VMFDTOtoto I tried to run Logstash in debug mode but nothing out of the ordinary came up : [https://gist.githubusercontent.com/Antoine-SSAG/5685613990ffd0bfe13f991726c666b2/raw/f84b097cf740fdb6395d4aa6a97ef70212d9d436/debug.txt](https://gist.githubusercontent.com/Antoine-SSAG/5685613990ffd0bfe13f991726c666b2/raw/f84b097cf740fdb6395d4aa6a97ef70212d9d436/debug.txt) The parsing is failling when I try to get the Windows user in the log after the Level ( Domain\User). My input is : > input { > beats{ > port =\> 5018 > type =\> AppPCI > tags =\> [P101] > } > } > filter { > grok { > match =\> { "message" =\> "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601\_TIMEZONE}? %{IPV4:IP} %{UNIXPATH:Chemin} %{TIMESTAMP\_ISO8601:logTime} %{LOGLEVEL:Loglevel} %{WORD:Domain}\%{WORD:user} %{GREEDYDATA:AppLog}" } > } > } > output { > if [type] == "AppPCI" { > elasticsearch { > index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-apppci-%{+YYYY.MM.dd}" > hosts =\> ["[http://10.254.160.15:9200](http://10.254.160.15:9200)"] > } > } > } I'm really getting desesperate so if somebody have an idea it would be really nice. Thanks in advance, Antoine ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [May 24, 2019, 3:35pm UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/2 "2019-05-24T15:35:34Z")
> [@Antoine.E](#): > > %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601\_TIMEZONE}? %{IPV4:IP} %{UNIXPATH:Chemin} %{TIMESTAMP\_ISO8601:logTime} %{LOGLEVEL:Loglevel} %{WORD:Domain}%{WORD:user} %{GREEDYDATA:AppLog} I think you dont need the part before %{IPV4:IP}. And -\> `%{WORD:Domain}\%{WORD:user}` is escaping the "%" so you need another one like `%{WORD:Domain}\\%{WORD:user}` I hope this will help. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 24, 2019, 4:07pm UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/3 "2019-05-24T16:07:48Z")
> [@Antoine.E](#): > > %{UNIXPATH:Chemin} Do not use [UNIXPATH](https://github.com/logstash-plugins/logstash-patterns-core/issues/159). It is extremely CPU intensive. ---
**Author:** ![Antoine.E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine.e/32/41348_2.png) [@Antoine.E](https://discuss.elastic.co/u/Antoine.E)\ **Post date:** [May 25, 2019, 9:03am UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/4 "2019-05-25T09:03:48Z")
Hello Logger, Thanks for taking the time to help, I removed to part before the %{IPV4:IP} and it works perfectly, 😄 I also added the \ before i'm not sure why it showed as a single backslash. Thanks for the tips ^^ ---
**Author:** ![Antoine.E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine.e/32/41348_2.png) [@Antoine.E](https://discuss.elastic.co/u/Antoine.E)\ **Post date:** [May 25, 2019, 9:14am UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/5 "2019-05-25T09:14:49Z")
Hello Badger, YOu are my saviour ! I don't know why but the UNIXPATH pattern was what caused the grock to crash, when i use a custom one, eveything works perfectly fine. If it happen to other people, I used this custom regex : URL (?=/)((.\*?))(?=) In the end with the advice of @logger my filter look like that : > %{IPV4:IP} %{URL:Chemin} %{TIMESTAMP\_ISO8601:logTime} %{LOGLEVEL:Loglevel} %{WORD:Domain}\%{WORD:user} %{MESSAGE:AppLog} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 22, 2019, 9:15am UTC](https://discuss.elastic.co/t/grock-parsing-high-cpu-not-stopping/182682/6 "2019-06-22T09:15:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.