grok does not directly limit the size of the message field. I wouldn't assume that a grok debugger matches in the same way that grok does.
The "Value too large to output" is just the filter not wanting to log a very long log message, so it only prints the first 256 bytes of the field. It is still matching against the entire field.
Without seeing the pattern you are matching it is hard to suggest much. Read this blog on grok performance. Anchor patterns whenever possible, avoid multiple GREEDYDATA in the same pattern. See if DATA and GREEDYDATA can be replaced by more specific patterns (e.g. NOTSPACE, or a custom pattern that consumes text up to a delimiter).
I was going to point to UNIXPATH as an example of pattern to avoid since it can be monstrously expensive. However, it turns out this was fixed last year. The change basically just removed the alternation!