Issue parsing db2diag log using grok filter

A pattern with twelve DATA and twelve GREEDYDATA is going to be ridiculously expensive if it fails to match. It may well exceed the 30 second timeout. I would suggest you match multiple patterns to pick out parts of the message

    grok {
        break_on_match => false
        match => {
            "message" => [
                "PID : %{NOTSPACE:pid}",
                "TID : %{NOTSPACE:tid}",
                "INSTANCE: %{NOTSPACE:instance}",
                "NODE : %{NOTSPACE:node}",
                "MESSAGE : %{GREEDYDATA:msg}"
            ]
        }
    }

etc.