Do not match the entire message to a pattern that contains several GREEDYDATA fields. A slight change in the input that prevents a match will make that extremely expensive. Instead go after each piece separately, and anchor the patterns to the start of a line.
grok {
break_on_match => false
match => {
"message" => [
# "^Loaded archive '%{DATA:archive_number}' to hosts running group" ?
"^%{DATA:archive_number} to hosts running group",
"^Failures detected%{GREEDYDATA:infos}",
"^Gateway instance \[GW-1\] %{DATA:deploy_GW-1}^(Gateway instance|Failures detected)",
"^Gateway instance \[GW-2\] %{DATA:deploy_GW-2}^(Gateway instance|Failures detected)"
]
}
remove_field => [ "message" ]
}
will produce the output you want, but is more robust to changes.