# Logstash issue grok **URL:** \ **Category:** Logstash\ **Created:** [May 25, 2015, 11:47am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251 "2015-05-25T11:47:04Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![alexmac](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@alexmac](https://discuss.elastic.co/u/alexmac)\ **Post date:** [May 25, 2015, 11:47am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/1 "2015-05-25T11:47:04Z")
Hi, I`m having an issue with logsasher, after sending couple of events it stop sending logs to elastic. basically I`m inputing AWS ELB logs, extracting the url\_path on first match and continue extracting additional data from the "url\_path" I`ve set costume patterns: DEVICEBREAK [^/]+[^/]+/(?\[^/]+)+/devices/%{WORD:request\_type:String}[?]device\_id=%{WORD:device\_id}&key=%{WORD:key} KEYBREAK [^/]+[^/]+/(?\[^/]+)+/devices/%{WORD:request\_type:String}[?]key=%{WORD:key}&device\_id=%{WORD:device\_id} APIBREAK [^/]+[^/]+/(?\[^/]+)+/api\_wrappers/connection/domain[?]key=%{WORD:key}&domain\_api\_secret=%{WORD:api\_secret}&user\_id=%{BASE10NUM:user\_id} SPIDRBREAK [^/]+[^/]+/(?\[^/]+)+/users/%{WORD:request\_type:String}/communications/spidr[?]key=%{WORD:key} USERBREAK [^/]+[^/]+/(?\[^/]+)+/users/devices[?]key=%{WORD:key} DATEBREAK [^/]+[^/]+/(?\[^/]+)+/users/%{WORD:request\_type:String}/data\_channel[?]key=%{WORD:key} GSSBREAK [^/]+[^/]+/(?\[^/]+)+/gss/wrapper/user[?]key=%{WORD:key} CREDBREAK [^/]+[^/]+/(?\[^/]+)+/devices/%{WORD:request\_type:String}/push[?]key=%{WORD:key}&device\_id=%{WORD:device\_id} My config file: input { file { path =\> "/var/log/s3/elb-us-logs/\*.log" type =\> "elb" start\_position =\> "beginning" sincedb\_path =\> "log\_sincedb" } } filter { if [type] == "elb" { grok { break\_on\_match =\> false patterns\_dir =\> "./patterns" match =\> [ "message" , [ "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string} %{URI:url\_path} HTTP%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IPORHOST:clientIp}:%{NUMBER:backend\_port:int} - -1 -1 -1 %{NUMBER:elb\_status\_code:int}" ] ] patterns\_dir =\> "./patterns" match =\> [ "url\_path", [ "%{DEVICEBREAK}", "%{KEYBREAK}", "%{APIBREAK}", "%{SPIDRBREAK}", "%{USERBREAK}", "%{DATEBREAK}", "%{GSSBREAK}", "%{CREDBREAK}" ] ] } } The log file looks like this: "2015-05-25T09:45:51.110114Z extelb-name-API 100.0.54.51:56841 172.18.3.80:80 0.000049 0.023448 0.000022 200 200 0 57 "GET [https://api.somedomain.io:443/v1.1/devices/messages?device\_id=7A7509DE74DF4654B0919878D7C84B3D&key=UAT4fa560d246c8476ba27a3dda3a64d630](https://api.somedomain.io:443/v1.1/devices/messages?device_id=7A7509DE74DF4654B0919878D7C84B3D&key=UAT4fa560d246c8476ba27a3dda3a64d630) HTTP/1.1"", Any help will be appreciated, thanks. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2015, 11:52am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/2 "2015-05-25T11:52:28Z")
Why do you think this has anything to do with grok? Is there anything interesting in the Logstash logs if you turn up the logging with `--verbose` or even `--debug`? ---
**Author:** ![alexmac](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@alexmac](https://discuss.elastic.co/u/alexmac)\ **Post date:** [May 25, 2015, 11:58am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/3 "2015-05-25T11:58:01Z")
> [@magnusbaeck](#): > > --verbose or even --debug running logstash -f etc/conf.d/server.conf -vvv find's a match and send the log, but after one hit it stops streaming anything. removing match =\> ["url\_path"] make it works without a problem. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2015, 12:22pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/4 "2015-05-25T12:22:30Z")
And new data is actually being appended to at least one of the files in /var/log/s3/elb-us-logs/\*.log? ---
**Author:** ![alexmac](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@alexmac](https://discuss.elastic.co/u/alexmac)\ **Post date:** [May 25, 2015, 12:30pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/5 "2015-05-25T12:30:05Z")
Yes, there is a cron job that syncs new files every 5 mins. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 25, 2015, 2:47pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/6 "2015-05-25T14:47:01Z")
@alexmac Thx for this report, Would you mind sharing a thread dump using `jstack` when logstash stop processing events? See [http://docs.oracle.com/javase/7/docs/technotes/tools/share/jstack.html](http://docs.oracle.com/javase/7/docs/technotes/tools/share/jstack.html) for documentation. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 25, 2015, 2:49pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/7 "2015-05-25T14:49:17Z")
Also, @alexmac did you upgrade from 1.4.2 to 1.5.0? ---
**Author:** ![alexmac](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@alexmac](https://discuss.elastic.co/u/alexmac)\ **Post date:** [May 25, 2015, 3:20pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/8 "2015-05-25T15:20:20Z")
Hey, I've tried using the same config for version 1.5 same thing. I`m currently using version 1.4.2. I did another test instead of using pattern file, I`m currenty only using one grok match: "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/devices/%{WORD:request\_type:String}[?]device\_id=%{UUID:device\_id}[&]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"" The message that I receive: extelb-Kandy-API 97.65.224.2:16333 172.18.3.23:80 0.000036 0.003172 0.00002 200 200 0 90 "GET [https://api.somedomain.io:443/v1.2/devices/messages?device\_id=5A07CC7BA86E416D88AB407DBEDDF9C8&key=UATf7d4f3d5fdc7481da1a5bfb52364f812](https://api.somedomain.io:443/v1.2/devices/messages?device_id=5A07CC7BA86E416D88AB407DBEDDF9C8&key=UATf7d4f3d5fdc7481da1a5bfb52364f812) HTTP/1.1" I've tested the grok with grokdebugger and it seems to break everything correctly. but when I start it it fails to process the log and tags it with \_grokparsefailure ---
**Author:** ![PeterF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peterf/32/5088_2.png) [@PeterF](https://discuss.elastic.co/u/PeterF)\ **Post date:** [May 26, 2015, 1:59pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/9 "2015-05-26T13:59:38Z")
Hello, I'm having a similar issue with LS processing for a few seconds and then stopping. Here's my conf: input{ tcp { port =\> 20514 type =\> "syslog" } } filter { grok { match =\> ["message", "%{SYSLOGTIMESTAMP:@timestamp} %{SYSLOGHOST:hostname} (?\{._})"] #match =\> ["message", "{"Time":"%{SYSLOGTIMESTAMP:timestamp}","Type":"%{DATA:Type}","Hostname":"%{DATA:Hostname}","SourceModuleName":"%{DATA:SourceModuleName}","Logger":"%{DATA:Logger}","Severity":"%{DATA:Severity}","Message":" %{DATA}=%{TIME:time} %{DATA}=%{DATA:devname} %{DATA}=%{DATA:device\_id} %{DATA}=%{DATA:log\_id} %{DATA}=%{DATA:type} %{DATA}=%{DATA:subtype} %{DATA}=%{DATA:pri} %{DATA}=%{DATA:vd} %{DATA}=%{DATA:SN} %{DATA}=%{DATA:duration} %{DATA}=%{DATA:user} %{DATA}=%{DATA:group} %{DATA}=%{DATA:rule} %{DATA}=%{DATA:policyid} %{DATA}=%{DATA:proto} %{DATA}=%{DATA:service} %{DATA}=%{DATA:app\_type} %{DATA}=%{DATA:status} %{DATA}=%{DATA:src} %{DATA}=%{DATA:srcname} %{DATA}=%{DATA:dst} %{DATA}=%{DATA:dstname} %{DATA}=%{DATA:src\_int} %{DATA}=%{DATA:dst\_int} %{DATA}=%{DATA:sent} %{DATA}=%{DATA:rcvd} %{DATA}=%{DATA:sent\_pkt} %{DATA}=%{DATA:rcvd\_pkt} %{DATA}=%{DATA:src\_port} %{DATA}=%{DATA:dst\_port} %{DATA}=%{DATA:vpn} %{DATA}=%{DATA:tran\_ip} %{DATA}=%{DATA:tran\_port} %{DATA}=%{DATA:dir\_disp} %{DATA}=%{DATA:tran\_disp} "}"] match =\> ["message", "(?\{._})"] match =\> ["message", "%{SYSLOGTIMESTAMP:@timestamp} %{SYSLOGHOST:hostname} %{GREEDYDATA:Message}"] } json { source =\> "json\_msg" remove\_field =\> ["json\_msg"] #remove\_field =\> ["message"] } mutate { gsub =\> [ "Severity", "ERR$", "ERROR", "Severity", "EMERG", "ERROR", "Severity", "ALERT", "ERROR", "Severity", "WARN$", "WARNING", "Severity", "NOTICE", "WARNING" ] } } output{ elasticsearch{ host =\> localhost protocol =\> http } } NOTE: The second grok match (currently commented out). This configuration runs no problem, however, if I uncomment the 2nd grok match, Logstash runs for about 15 seconds and then goes away to la la land. It continues to run taking 100% CPU, but fails to respond to stop, start or restart commands; it does not send any data to ES nor does it seem to accept any data from our relays. In fact the only thing it responds to is kill -9. Any help? Input and grok tested with grok debugger CentOS Linux release 7.0.1406 (Core) Java 1.8 Logstash 1.5 (I tried on 1.4 and same issue). ---
**Author:** ![PeterF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peterf/32/5088_2.png) [@PeterF](https://discuss.elastic.co/u/PeterF)\ **Post date:** [May 26, 2015, 2:02pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/10 "2015-05-26T14:02:06Z")
Sorry, forgot to add: nothing in logstash.log,err or stdout If you run LS with --verbose, it shows the messages being processed and then it just stops... (i.e. the output as it processes logs simply comes to a halt, no more data is displayed). ---
**Author:** ![alexmac](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@alexmac](https://discuss.elastic.co/u/alexmac)\ **Post date:** [May 27, 2015, 1:24pm UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/11 "2015-05-27T13:24:22Z")
Ok, I've found a workaround for this issue. I've parsed really big and ugly regex, for now it seems good enough. grok { break\_on\_match =\> false patterns\_dir =\> "./patterns" match =\> [ "message" , [ "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]device\_id=%{WORD:device\_id}[&]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}[&]client\_timestamp=%{NUMBER:client\_timestamp}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/devices/%{WORD:request\_type:String}/hints[?]key=%{WORD:key}[&]device\_id=%{UUID:device\_id}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/last\_seen[?]users=%{GREEDYDATA}[&]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}[&]messages=%{GREEDYDATA:messages}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]user\_id=%{UUID:user\_id}[&]user\_password=%{WORD:password}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]%{WORD}=%{GREEDYDATA}[&]device\_id=%{WORD:device\_id}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}[&]client\_timestamp=%{NUMBER:client\_timestamp}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/%{WORD}[?]key=%{GREEDYDATA:key} HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/%{WORD}/%{WORD}/%{WORD}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]%{WORD}=%{NUMBER:client\_sw\_version:Int}[&]%{WORD}=%{WORD:client\_sw\_type}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/%{WORD}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/personal[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/device[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/devices[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/communications/spidr[?]key=%{WORD:key}[&]secure=true%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/wrapper/%{WORD:request\_type:String}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/%{WORD}/id[?]session\_id=%{WORD:session\_id}[&]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/%{WORD}[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/details/limited[?]key=%{WORD:key}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/push[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/api\_wrappers/%{WORD:request\_type:String}/domain[?]key=%{WORD:key}[&]domain\_api\_secret=%{WORD:api\_secret}[&]user\_id=%{WORD:user\_id:Int}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]domain\_api\_secret=%{WORD:domain\_api\_secret}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "(%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/api\_wrappers/%{WORD:request\_type:String}/domain[?]key=%{WORD:key}[&]domain\_api\_secret=%{UUID:api\_secret}[&]user\_id=%{UUID:user\_id})%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]MCC=%{NUMBER}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/api\_wrappers/%{WORD:request\_type:String}[?]key=%{WORD:key}[&]user\_id=%{NUMBER:user\_id}[&]user\_password=%{WORD:user\_password}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_type:String}/%{WORD}[?]key=%{GREEDYDATA:key} HTTP+%{URIPATHPARAM}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/push[?]key=%{WORD:key}[&]device\_id=%{WORD:device\_id}[&]client\_sw\_version=%{NUMBER:client\_sw\_version}[&]client\_sw\_type=%{WORD:client\_type}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"", "%{NOTSPACE:loadbalancer} %{IP:client\_ip}:%{NUMBER:client\_port:int} %{IP:backend\_ip}:%{NUMBER:backend\_port:int} %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} %{NUMBER:elb\_status\_code:int} %{NUMBER:backend\_status\_code:int} %{NUMBER:received\_bytes:int} %{NUMBER:sent\_bytes:int} "%{WORD:method:string}%{SPACE}%{URIPROTO}://%{URIHOST:domain}/^/+/%{WORD:request\_handler:String}/%{WORD:request\_type:String}/user[?]%{WORD}=%{NUMBER:client\_sw\_version}[&]%{WORD}=%{WORD:client\_sw\_type}[&]%{WORD}=%{GREEDYDATA:device\_version}[&]device\_family=%{WORD:device\_family}&%{WORD}=%{GREEDYDATA:device\_name}[&]device\_native\_id=%{NUMBER:device\_native\_id}[&]kandy\_device\_id=%{WORD:device\_id}[&]key=%{WORD:key}[&]full\_user\_id=%{GREEDYDATA:full\_user\_id}[&]user\_password=%{WORD:user\_password}%{SPACE}HTTP+%{URIPATHPARAM:httpversion}"" ] ] } ---
**Author:** ![PeterF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peterf/32/5088_2.png) [@PeterF](https://discuss.elastic.co/u/PeterF)\ **Post date:** [May 29, 2015, 7:21am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/12 "2015-05-29T07:21:48Z")
Alex, Other than transforming your match pattern, did you do anything else to logstash to prevent it from becoming unresponsive? cheers Peter ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/logstash-issue-grok/1251/13 "2017-07-06T05:39:05Z")