# Issue parsing db2diag log using grok filter

**URL:** https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957
**Category:** Logstash
**Created:** [August 19, 2021, 12:39pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957 "2021-08-19T12:39:31Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 19, 2021, 3:10pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/2 "2021-08-19T15:10:51Z")

</div>

A pattern with twelve DATA and twelve GREEDYDATA is going to be ridiculously expensive if it fails to match. It may well exceed the 30 second timeout. I would suggest you match multiple patterns to pick out parts of the message

```
    grok {
        break_on_match => false
        match => {
            "message" => [
                "PID : %{NOTSPACE:pid}",
                "TID : %{NOTSPACE:tid}",
                "INSTANCE: %{NOTSPACE:instance}",
                "NODE : %{NOTSPACE:node}",
                "MESSAGE : %{GREEDYDATA:msg}"
            ]
        }
    }

```

etc.

---

_[View the full topic](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957)._