A pattern with twelve DATA and twelve GREEDYDATA is going to be ridiculously expensive if it fails to match. It may well exceed the 30 second timeout. I would suggest you match multiple patterns to pick out parts of the message
grok {
break_on_match => false
match => {
"message" => [
"PID : %{NOTSPACE:pid}",
"TID : %{NOTSPACE:tid}",
"INSTANCE: %{NOTSPACE:instance}",
"NODE : %{NOTSPACE:node}",
"MESSAGE : %{GREEDYDATA:msg}"
]
}
}
etc.