# Grok performance

**URL:** https://discuss.elastic.co/t/grok-performance/112577
**Category:** Logstash
**Created:** [December 20, 2017, 7:58am UTC](https://discuss.elastic.co/t/grok-performance/112577 "2017-12-20T07:58:46Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 20, 2017, 7:58am UTC](https://discuss.elastic.co/t/grok-performance/112577/1 "2017-12-20T07:58:47Z")

</div>

hi there!

i use multiple grok match patterns in my logstash filter.

eg:

> filter {  
> grok {  
> # grok1  
> break\_on\_match =\> true  
> match =\> { "message" =\> ["^(?\<log\_timestamp\>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{1,3})._?(?\d+)\s{0,}%{WORD:log\_level}._?\s:\sV21.OneTwoThreeHelper\s:\sPageRequest\s{0,}::\s{0,}(?\<session\_id\>\w+)\s{0,}._?._?(?[0-9a-zA-Z]{0,})(?._?)"]}  
> add\_field =\> { "project\_type" =\> "PROJ1" }  
> add\_field =\> { "transaction\_type" =\> "REQUEST" }  
> }  
> grok {  
> # grok2  
> break\_on\_match =\> true  
> match =\> { "message" =\> ["(?\<log\_timestamp\>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{1,3})._(?\d+)._?%{WORD:log\_level}._?\s:\sPageResponse\s{0,}::\s{0,}(?\<session\_id\>\w+)\s{0,}::\s{0,}._?._?(?[0-9a-zA-Z]{0,})(?._?)"]}   
> add\_field =\> { "project\_type" =\> "PROJ2" }  
> add\_field =\> { "transaction\_type" =\> "RESPONSE" }  
> }  
> grok {  
> # grok3  
> break\_on\_match =\> true  
> match =\> { "message" =\> ["(?\<log\_timestamp\>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{1,3})._(?\d+)._?%{WORD:log\_level}._?\s:\sPage3\s{0,}::\s{0,}(?\<session\_id\>\w+)\s{0,}::\s{0,}._?._?(?[0-9a-zA-Z]{0,})(?.\*?)"]}   
> add\_field =\> { "project\_type" =\> "PROJ3" }  
> add\_field =\> { "transaction\_type" =\> "RESPONSE" }  
> }  
> grok {....}  
> grok {....}  
> grok {grok40}  
> }

1. by using break\_on\_match =\> true, if log event match grok2, then exit grok2 or exit filter?
2. i use 40 groks line, i’m not sure about performance impact on using multiple grokking. may i know how to improve performance and how to prepare / manage the logstash performance?

if someone give advice those, appreciate 🙂

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 20, 2017, 4:47pm UTC](https://discuss.elastic.co/t/grok-performance/112577/2 "2017-12-20T16:47:04Z")

</div>

Grok allows you to define multiple panterns in the same block, and this is where the 'break\_on\_match' parameter is useful in order to stop processing once a match is found. If you have multiple grok blocks, they will all be evaluated as the parameter does not span across blocks.

---

<div class="post-metadata">

### Author: ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 21, 2017, 2:24am UTC](https://discuss.elastic.co/t/grok-performance/112577/4 "2017-12-21T02:24:14Z")

</div>

hi @Christian_Dahlqvist

thank you

i thought if grok match, exit grok block ignoring next line which is add\_field.  
that's why i wrote multiple block 😃

right now, i change one grok block and turn on break\_on\_match  
then... i found that

project\_type: PROJ1,PROJ2,PROJ3,.....PROJ40  
transaction: REQUEST,RESPONSE,TEST,etc.

break\_on\_match only ignore next patterns but it still on going add\_field.  
what should i change about that? plz, kindly check my script again.

---

<div class="post-metadata">

### Author: ![neal1991](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neal1991/32/23178_2.png) [@neal1991](https://discuss.elastic.co/u/neal1991)
#### Post date: [December 21, 2017, 7:33am UTC](https://discuss.elastic.co/t/grok-performance/112577/5 "2017-12-21T07:33:38Z")

</div>

> **[Do you grok Grok?](https://www.elastic.co/blog/do-you-grok-grok)**
>
> There are over 200 grok patterns available, so how do you know what way will work best for you? Let us help you grok Grok.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 21, 2017, 4:04pm UTC](https://discuss.elastic.co/t/grok-performance/112577/6 "2017-12-21T16:04:55Z")

</div>

It will add field if there is a successful match for one of the panterns in the block. Can you perhaps define the project at the source, e.g. in Filebeat, or using conditionals on the fields after the data has been extracted?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2018, 4:05pm UTC](https://discuss.elastic.co/t/grok-performance/112577/7 "2018-01-18T16:05:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.