# Grok gives an error, causing cpu to be high
**URL:** https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465
**Category:** Logstash
**Created:** [March 1, 2019, 9:29am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465 "2019-03-01T09:29:18Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@shenshensinian](https://discuss.elastic.co/u/shenshensinian)
#### Post date: [March 1, 2019, 9:29am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/1 "2019-03-01T09:29:18Z")
Hello, I don't know why I set the matching specifications, logstash keeps getting error log and cpu usage rate rises rapidly.
The error log is as follows:
[WARN][logstash.filters.grok] Timeout executing grok '(._?)"%{GREEDYDATA:timestamp}" fw=%{HOSTNAME:HostName}(._?)user=%{USERNAME:UserName}(._?)%{IP:SourceAddress} op="%{USERNAME:UserLogging}"(._?)user login(.\*?)' against field 'message' with value 'Value too large to output (534 bytes)! First 255 chars are:
A single sample log message is as follows:
id=tos time="2008-5-14 06:53:10" fw=TopsecOS pri=6 type=ips recorder=IPSAR proto=tcp src=192.168.3.2 sport=80 dst=192.168.2.2 dport=69000 rule= repeat= msg= appendix= application="qq" op="block" interface= sdev=eth10 ddev=eth11
id=tos time="2008-5-14 06:53:10" fw=TopsecOS pri=6 type=ips recorder=IPSAR proto=tcp src=192.168.3.2 sport=80 dst=192.168.2.2 dport=69000 rule= repeat= msg= appendix= application="qq" op="block" interface= sdev=eth10 ddev=eth11
id=tos time="2008-5-14 06:53:10" fw=TopsecOS pri=6 type=ips recorder=IPSAR proto=tcp src=192.168.3.2 sport=80 dst=192.168.2.2 dport=69000 rule= repeat= msg= appendix= application="qq" op="block" interface= sdev=eth10 ddev=eth11
id=tos time="2008-5-14 06:53:10" fw=TopsecOS pri=6 type=ips recorder=IPSAR proto=tcp src=192.168.3.2 sport=80 dst=192.168.2.2 dport=69000 rule= repeat= msg= appendix= application="qq" op="block" interface= sdev=eth10 ddev=eth11
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [March 1, 2019, 10:01am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/2 "2019-03-01T10:01:47Z")
> [@shenshensinian](#):
>
> (. _?)"%{GREEDYDATA:timestamp}" fw=%{HOSTNAME:HostName}(._ ?)user=%{USERNAME:UserName}(. _?)%{IP:SourceAddress} op="%{USERNAME:UserLogging}"(._ ?)user login(.\*?)
are you sure your using correct grok pattern and let me know what value you need to extract
---
### Author:  [@shenshensinian](https://discuss.elastic.co/u/shenshensinian)
#### Post date: [March 1, 2019, 10:18am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/3 "2019-03-01T10:18:58Z")
There is also no prompt problem with the grok online matching test. What do you mean by the value?
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [March 1, 2019, 10:21am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/4 "2019-03-01T10:21:20Z")
which message your try to extract with this pattern
---
### Author:  [@shenshensinian](https://discuss.elastic.co/u/shenshensinian)
#### Post date: [March 1, 2019, 10:27am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/5 "2019-03-01T10:27:31Z")
Still keep reporting errors, can you help me write a change and let me test it?
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [March 1, 2019, 10:45am UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/6 "2019-03-01T10:45:46Z")
can you share your logstash config file
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2019, 1:02pm UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/7 "2019-03-01T13:02:53Z")
Patterns that start with GREEDYDATA are very expensive because they have to backtrack and retry so much. This can result in timeouts.
Why not use
```
kv { whitespace => "strict" }
```
which will parse the first line as
```
"sequence" => 0,
"pri" => "6",
"dst" => "192.168.2.2",
"proto" => "tcp",
"sport" => "80",
"dport" => "69000",
"application" => "qq",
"op" => "block",
"ddev" => "eth11",
"time" => "2008-5-14 06:53:10",
"type" => "ips",
"fw" => "TopsecOS",
"recorder" => "IPSAR",
"sdev" => "eth10",
"id" => "tos",
"src" => "192.168.3.2"
```
Empty fields such as rule, repeat, msg and appendix are discarded.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2019, 1:02pm UTC](https://discuss.elastic.co/t/grok-gives-an-error-causing-cpu-to-be-high/170465/8 "2019-03-29T13:02:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.