You're not running Logstash 1.4.x and having trouble with the Logstash Web process, are you? Because it had a tendency to eat CPU once installed.
If it indeed is the agent that's consuming all that CPU, simplifying that regexp should help. It looks like you're trying to match continuation lines to make them meld with the previous line. I usually find it easier to craft an expression that matches non-continuation lines and set negate => true.
What kind of message rate are you seeing?