Grok_timeout coming in logstash logs

Elastic Stack Logstash
1

when i process multiple type of logs by grok parser ,if the one of logline is not matched with the filter parser ,then i am excepting that it should be come grok parser faliure ,but it comes grok timeout warning in Logstash logs.

if its coming grok timeout why it takes so longer time?can i reduce the process time ,then its return warnings in logs.

2

The grok timeout can be caused by:

  • wrong fields type for instance too often GREEDYDATA is used - no optimization
  • use multi match patterns instead of optional fields or OR fields
  • not measuring data performances, by node/pipeline stat
  • using grok instead dissect, csv, kv ...
  • poor memory/CPU resources
  • too many log fields

I would check by this order. Sometimes is better to go for another plugin, if is possible. The default timeout is 30 sec, however anything above 3-5 sec in case of plain lines is a signal for the optimization.

In your case, it's hard to say without sample messageS and grok patternS which you use.

3

Also, anchor your patterns. Read this blog post.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.