# Grok parse failure on working grok debugger

**URL:** <https://discuss.elastic.co/t/grok-parse-failure-on-working-grok-debugger/191039>\
**Category:** Logstash\
**Created:** [July 17, 2019, 3:16pm UTC](https://discuss.elastic.co/t/grok-parse-failure-on-working-grok-debugger/191039 "2019-07-17T15:16:46Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 17, 2019, 3:57pm UTC](https://discuss.elastic.co/t/grok-parse-failure-on-working-grok-debugger/191039/4 "2019-07-17T15:57:29Z")

</div>

Do not match the entire message to a pattern that contains several GREEDYDATA fields. A slight change in the input that prevents a match will make that extremely expensive. Instead go after each piece separately, and anchor the patterns to the start of a line.

```
    grok {
        break_on_match => false
        match => {
            "message" => [
                # "^Loaded archive '%{DATA:archive_number}' to hosts running group" ?
                "^%{DATA:archive_number} to hosts running group",
                "^Failures detected%{GREEDYDATA:infos}",
                "^Gateway instance \[GW-1\] %{DATA:deploy_GW-1}^(Gateway instance|Failures detected)",
                "^Gateway instance \[GW-2\] %{DATA:deploy_GW-2}^(Gateway instance|Failures detected)"
            ]
        }
        remove_field => ["message"]
    }

```

will produce the output you want, but is more robust to changes.

---

_[View the full topic](https://discuss.elastic.co/t/grok-parse-failure-on-working-grok-debugger/191039)._