# Logstash filter taking. high cpu

**URL:** <https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550>\
**Category:** Logstash\
**Created:** [September 16, 2022, 6:35am UTC](https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550 "2022-09-16T06:35:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishan.kumar](https://avatars.discourse-cdn.com/v4/letter/k/e480ec/32.png) [@krishan.kumar](https://discuss.elastic.co/u/krishan.kumar)\
**Post date:** [September 16, 2022, 6:35am UTC](https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550/1 "2022-09-16T06:35:54Z")

</div>

Hi,

My logstash grok pattern taking high CPU

This is my log format  
`I, [2022-09-16T06:27:40.386003 #13375] INFO -- : [s45g0-e726-56y7-adcf-3382276c1a77] [user_id: xxxxxx, portfolio_id: xxxxxxx] {"method":"GET","path":"/api/v5/most.json","format":"json","controller":"V5::MostFollowedController","action":"index","status":200,"duration":3.05,"view":0.18,"db":0.0,"params":{"v":"1.204.6"},"exception":null,"exception_object":null,"remote_ip":"122.164.248.211","@timestamp":"2022-09-16T06:27:40.385Z","@version":"1","message":"[200] GET /api/v5/most.json (V5::MostFollowedController#index)"}`

this is my grok pattern

````nohighlight
      grok {
            match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\]%{SPACE}%{LOGLEVEL:event_level} -- :%{SPACE} %{DATA:user_name} %{DATA:user_id1} %{DATA:user_id}\, %{DATA:pfid1} %{DATA:portfolioid}\] %{GREEDYDATA:json_data}" }
    }
      }

filter{
  json{
    source => "json_data"
    target => "parsed_json"
  }
 }```

can you please suggest to me why logstash taking too much cpu
````

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2022, 6:36am UTC](https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550/2 "2022-10-14T06:36:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.