Logstash goes to 100% cpu and stops logging after a while

Elastic Stack Logstash
1

Logstash 2.2.1 is installed on a CentOS 6 system

Server has 4 gig memory, and 4 CPUs

Logs come into the server via rsyslog, local rsyslog sends to local port 5544

It works fine for a while, then it goes to 100% cpu on 2 cpus (today it was 3), and after a while it just stops logging. It doesn't respond to a simple "service logstash stop", I have to kill -9 the process

There are only two simple grok filters, one for apache and one for nginx.

I did verify that logs were coming into the server by putting a rule into rsyslog to write the logs to a local file as well

Any ideas?

02-syslog-input.conf
input {
tcp {
port => 5544
type => syslog
}
udp {
port => 5544
type => syslog
}
}

filter {
  # This replaces the host field (UDP source) with the host that generated the message (sysloghost)
  if [sysloghost] {
    mutate {
      replace => [ "host", "%{sysloghost}" ]
      remove_field => "sysloghost" # prune the field after successfully replacing "host"
    }
  }
}

13-apache.conf
#
# Grok both the standard apache combined log and our modified version
#
filter{
if[type] == "syslog" and [message] =~ "apache" {
grok {
match => [
"message", "%{COMBINEDAPACHELOG}" ,
"message", "%{COMBINEDAPACHELOG2}",
# "message", "%{APACHE_ERROR_LOG}",
"message", "%{SSLCOMBINEDAPACHELOG2}"
]

		}
		date {
			match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
		}
	}
}

13-nginx.conf
#
# Grok our nginx logs
#
filter{
#if[type] == "nginx-access" {
if[type] == "syslog" and [message] =~ "nginx" {
grok {
patterns_dir => ["/opt/logstash/patterns", "/opt/logstash/extra_patterns"]
match => [
"message", "%{IPORHOST:http_host} %{IPORHOST:client_ip} [%{HTTPDATE:timestamp}] "(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})" %{NUMBER:http_status_code} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time_duration:float} %{NUMBER:time_backend_response:float}",
"message", "%{IPORHOST:http_host} %{IPORHOST:client_ip} [%{HTTPDATE:timestamp}] "(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})" %{NUMBER:http_status_code} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time_duration:float}",
"message", "%{NGINXACCESS}"
]
add_field => [ "received_at", "%{@timestamp}" ]
}
}
}

30-elasticsearch-output.conf
output {
elasticsearch { hosts => ["elasticsearch32:9200"] }
#stdout { codec => rubydebug }
}