# High CPU usage when log format not matching with filter rule **URL:** \ **Category:** Logstash\ **Created:** [November 9, 2020, 10:04am UTC](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728 "2020-11-09T10:04:05Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![4orty](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/4orty/32/82227_2.png) [@4orty](https://discuss.elastic.co/u/4orty)\ **Post date:** [November 9, 2020, 10:04am UTC](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728/1 "2020-11-09T10:04:05Z")
CPU utilization increases when data comes in that it does not meet the set rules.(grok pattern) Isn't there a defense logic to this phenomenon, such as preventing data from entering in case of failure of parsing? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 9, 2020, 3:57pm UTC](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728/2 "2020-11-09T15:57:00Z")
Patterns that do not match can be very expensive if they include multiple DATA or especially GREEDYDATA fields. The grok filter includes a [timeout](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-timeout_millis) to limit the CPU that non-matching patterns can use. The default is 30 seconds per pattern. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2020, 3:57pm UTC](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728/3 "2020-12-07T15:57:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.