# GROK filters timeout and 'value too large' message

**URL:** <https://discuss.elastic.co/t/grok-filters-timeout-and-value-too-large-message/99825>\
**Category:** Logstash\
**Created:** [September 8, 2017, 9:30am UTC](https://discuss.elastic.co/t/grok-filters-timeout-and-value-too-large-message/99825 "2017-09-08T09:30:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cuttlefishjones](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\
**Post date:** [September 8, 2017, 9:30am UTC](https://discuss.elastic.co/t/grok-filters-timeout-and-value-too-large-message/99825/1 "2017-09-08T09:30:12Z")

</div>

Hi, I'm having problems parsing custom Apache logs. I've built custom GROKS using the debugger website. On there they match instantly but when I put them into logstash they just constantly timeout or throw the 'value too large' error message.

The logs do not have a fixed layout in terms of spacing so I am using \s\*? to match that. Would that cause an issue with logstash that would not show up on the debugger site?

Sample pattern:

%{APRODLOGSTART} %{INT}\s\*?(-|+)\s\*?P%{INT}\s\*?%{INT}b\s\*?%{INT}b(%{INT:[system][apache][ratio]}%)\s\*?%{INT}us\s\*?%{HTTPACTION:[system][apache][action]}\s\*?%{URIPATH:[system][apache][url]} %{HTTPVER:[system][apache][http\_ver]}\s\*?%{UNIXPATH:[system][apache][path]}\s\*?"%{NOTSPACE:[system][apache][usergagent]}"\s\*?"%{NOTSPACE:[system][apache][origin]}"\s\*?U:%{NOTSPACE:[system][apache][unique\_id]} SecIn:%{INT:[system][apache][secin]} SecOut:%{INT:[system][apache][secout]}\s\*?%{TLS:[system][apache][tls\_ver]}? %{CIPHER:[system][apache][ciphers]}?

I have more complex patterns running on firewall logs without a problem. It's just the apache logs that are causing problems.

Any help would be appreciated!

---

<div class="post-metadata">

**Author:** ![cuttlefishjones](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\
**Post date:** [September 22, 2017, 9:25am UTC](https://discuss.elastic.co/t/grok-filters-timeout-and-value-too-large-message/99825/2 "2017-09-22T09:25:33Z")

</div>

I've fixed this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2017, 9:26am UTC](https://discuss.elastic.co/t/grok-filters-timeout-and-value-too-large-message/99825/3 "2017-10-20T09:26:12Z")

</div>

Closed on October 20, 2017, 9:26am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.