# Logstash CPU used 100% **URL:** \ **Category:** Logstash\ **Created:** [February 18, 2020, 6:50pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847 "2020-02-18T18:50:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![focheur91300](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@focheur91300](https://discuss.elastic.co/u/focheur91300)\ **Post date:** [February 18, 2020, 6:50pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/1 "2020-02-18T18:50:35Z")
Hello community, I have been encountering for some time a problem with the use of 100% of my CPU, on my logstash configuration. The problem occurred overnight. I am using the docker version of logstash version 7.5.2. Below my configuration. ``` input { syslog { port => 5044 } } # input { # beats { # port => 5043 # } # } filter { if [logsource] == "192.168.10.254" { mutate { add_tag => "pfsense" } } } filter { if "pfsense" in [tags] and [program] == "filterlog" { grok { match => { "message" => ".*?,.*?,.*?,%{NUMBER:ID_RULE},%{WORD:INTERFACE},.*?,%{WORD:ACTION},%{WORD:TRAFIC},%{NUMBER:IP_VERSION},.*?,.*?,.*?,.*?,.*?,.*?,.*?,%{WORD:PROTOCOL},.*?,%{IP:IP_SOURCE},%{IP:IP_DESTINATION},%{NUMBER:PORT_SOURCE},%{NUMBER:PORT_DESTINATION},%{NUMBER:DATA_LENGHT}" } match => { "message" => ".*?,.*?,.*?,%{NUMBER:ID_RULE},%{WORD:INTERFACE},.*?,%{WORD:ACTION},%{WORD:TRAFIC},%{NUMBER:IP_VERSION},.*?,*?,.*?,.*?,%{WORD:PROTOCOL},.*?,%{IP:IP_SOURCE},%{IP:IP_DESTINATION},%{NUMBER:PORT_SOURCE},%{NUMBER:PORT_DESTINATION},%{NUMBER:DATA_LENGHT}" } add_tag => "pfsense-filterlog" } geoip { source => "IP_SOURCE" target => "srcgeoip" } geoip { source => "IP_DESTINATION" target => "dstgeoip" } } if "pfsense" in [tags] and [program] == "pfblockerng_ip" { grok { match => { "message" => "%{SYSLOGTIMESTAMP},%{NUMBER:ID_RULE},%{WORD:INTERFACE},%{WORD:INTERFACE_NAME},%{WORD:ACTION},%{NUMBER:IP_VERSION},.*?,%{WORD:PROTOCOL}.*?,%{IP:IP_SOURCE},%{IP:IP_DESTINATION},%{NUMBER:PORT_SOURCE},%{NUMBER:PORT_DESTINATION},%{WORD:TRAFIC},%{WORD:GEOIP},%{WORD:ALIAS_GEO},.*?,%{WORD:ALIAS_NAME}," } add_tag => "pfsense-pfblockerng_ip" } geoip { source => "IP_SOURCE" target => "srcgeoip" } geoip { source => "IP_DESTINATION" target => "dstgeoip" } geoip { source => "IP_EVALUATED" target => "srcgeoip" } } if "pfsense" in [tags] and [program] == "barnyard2" { grok { patterns_dir => ["/usr/share/logstash/pipeline/patterns/pfsense"] match => { "message" => "\[%{SID:SID}]\s%{DESCRIPTION:DESCRIPTION}\s\[Classification\:\s%{CLASSIFICATION:CLASSIFICATION}\]\s\[Priority:\s%{NUMBER:PRIORITY}\]\:\s\<%{WORD:INTERFACE}\>\s\{%{WORD:PROTOCOL}\}\s%{IP:IP_SOURCE}\:%{NUMBER:PORT_SOURCE}\s\-\>\s%{IP:IP_DESTINATION}\:%{NUMBER:PORT_DESTINATION}" } add_tag => "pfsense-barnyard2" } geoip { source => "IP_SOURCE" target => "srcgeoip" } geoip { source => "IP_DESTINATION" target => "dstgeoip" } } if "pfsense" in [tags] and [program] == "unbound" { grok { patterns_dir => ["/usr/share/logstash/pipeline/patterns/pfsense"] break_on_match => false match => { "message" => [ ".*?info:\s%{IP:IP_SOURCE}\s%{FQDN:FQDN}\.\s", ".*?info:\s.*?\s.*?%{DOMAIN:DOMAIN}\.\s", ".*?info:\s.*?\s.*?%{TLD:TLD}\.\s" ] } add_tag => "pfsense-unbound" } } if "pfsense" in [tags] and [program] == "pfblockerng_dnsbl" { grok { patterns_dir => ["/usr/share/logstash/pipeline/patterns/pfsense"] break_on_match => false match => { "message" => [ ".*?%{SYSLOGTIMESTAMP},%{HOSTNAME:FQDN},%{IP:IP_SOURCE},.*?,.*?,%{WORD:ALIASGROUP},.*?,%{WORD:ALIASNAME},", ".*?%{SYSLOGTIMESTAMP},.*?%{DOMAIN:DOMAIN },", ".*?%{SYSLOGTIMESTAMP},.*?%{TLD:TLD}," ] } add_tag => "pfsense-pfblockerng_dnsbl" } } } output { if "pfsense-filterlog" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "pfsense-filterlog-%{+YYYY.MM.dd}" } } if "pfsense-pfblockerng_ip" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "pfsense-pfblockerng_ip-%{+YYYY.MM.dd}" } } if "pfsense-barnyard2" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "pfsense-barnyard2-%{+YYYY.MM.dd}" } } if "pfsense-unbound" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "pfsense-unbound-%{+YYYY.MM.dd}" } } if "pfsense-pfblockerng_dnsbl" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "pfsense-pfblockerng_dnsbl-%{+YYYY.MM.dd}" } } if "netflow" in [tags] { elasticsearch { hosts => "10.0.7.2:9200" index => "netflow-%{+YYYY.MM.dd}" } } else { elasticsearch { hosts => "10.0.7.2:9200" index => "logstash-%{+YYYY.MM.dd}" } } } ``` Thank you. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 18, 2020, 7:14pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/2 "2020-02-18T19:14:30Z")
> [@focheur91300](#): > > ``` > ".*?,.*?,.*?, > > ``` This will result in very expensive back tracking. Can you try [^,]\* instead of .\* ---
**Author:** ![focheur91300](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@focheur91300](https://discuss.elastic.co/u/focheur91300)\ **Post date:** [February 18, 2020, 7:31pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/3 "2020-02-18T19:31:22Z")
As follows OLD `.*?,.*?,.*?,%{NUMBER:ID_RULE},` NEW : `[^,]*.*?,.*?,%{NUMBER:ID_RULE},` An example below ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 18, 2020, 8:20pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/4 "2020-02-18T20:20:55Z")
No, I mean ``` "[^,]*,[^,]*,[^,]*,%{NUMBER:ID_RULE},%{WORD:INTERFACE},[^,]*,%{WORD:ACTION},%{WORD:TRAFIC},%{NUMBER:IP_VERSION},[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,[^,]*,%{WORD:PROTOCOL},[^,]*,%{IP:IP_SOURCE},%{IP:IP_DESTINATION},%{NUMBER:PORT_SOURCE},%{NUMBER:PORT_DESTINATION},%{NUMBER:DATA_LENGHT}" ``` ---
**Author:** ![focheur91300](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@focheur91300](https://discuss.elastic.co/u/focheur91300)\ **Post date:** [February 18, 2020, 10:24pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/5 "2020-02-18T22:24:07Z")
Thank you @Badger This has solved my problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 17, 2020, 10:24pm UTC](https://discuss.elastic.co/t/logstash-cpu-used-100/219847/6 "2020-03-17T22:24:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.