# Logstash -\> multiple match patterns increase my load average **URL:** \ **Category:** Logstash\ **Created:** [December 6, 2018, 7:29pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792 "2018-12-06T19:29:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\ **Post date:** [December 6, 2018, 7:29pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/1 "2018-12-06T19:29:44Z")
Hello, i am doing some parsing on my logstash. I have adde multiple patterns to my grok match, but the thing that is happening is that once i did that my load average increase too much. It is possible that the number of patters affect that? or that the regex can do it? i am receiving in average 50 logs per sec grok { patterns\_dir =\> ["${CFG\_DIR}/conf.d/patterns"] match =\> [ "message", "%{EVENTID\_4768\_4771}", "message", "%{EVENTID\_4776}", "message", "%{EVENTID\_4625}", "message", "%{EVENTID\_4740}", "message", "%{EVENTID\_4724\_4767\_4738\_4726}", "message", "%{EVENTID\_4742}", "message", "%{EVENTID\_4720}", "message", "%{EVENTID\_4741}", "message", "%{EVENTID\_18456}", "message", "%{FAILURE\_AUTH\_ACCOUNT}", "message", "%{SUCCESFUL\_AUTH\_ACCOUNT}", "message", "%{ACCOUNT\_CREATION}", "message", "%{ACCOUNT\_DELETION}", "message", "%{PASSWORD\_CHANGED}", "message", "%{PASSWORD\_CHANGED2}", "message", "%{FILE\_DELETION}", "message", "%{ACCESS\_ATTEMPT}", "message", "%{OBJECT\_DELETION}", "message", "%{GROUP\_DELETION}", "message", "%{GROUP\_CREATION}", "message", "%{PROGRAM\_INSTALLATION\_DELETION}", "message", "%{EVENTID\_4743}", "message", "%{EVENTID\_1033\_1034}", "message", "%{EVENTID\_4727\_4730}", "message", "%{EVENTID\_4728\_4729\_4752}", "message", "%{CATCH\_ALL}" ] } Here some of the regexs #EVENTID 4724 4767 4738 4726 EVENTID\_4724\_4767\_4738\_4726 \s\*%{GREEDYDATA:action}.\sSubject%{GREEDYDATA} Account Name:%{NOTSPACE:username\_doing}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain\_doing}%{GREEDYDATA}Target Account:%{GREEDYDATA}Account Name:%{NOTSPACE:username}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain} #EVENTID 4742 EVENTID\_4742 \s\*%{GREEDYDATA:action}.\sSubject%{GREEDYDATA} Account Name:%{NOTSPACE:username\_doing}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain\_doing}%{GREEDYDATA}Computer Account That Was Changed:%{GREEDYDATA}Account Name:%{NOTSPACE:username}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain} #EVENTID 4720 EVENTID\_4720 \s\*%{GREEDYDATA:action}.\sSubject%{GREEDYDATA} Account Name:%{NOTSPACE:username\_doing}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain\_doing}%{GREEDYDATA}New Account:%{GREEDYDATA}Account Name:%{NOTSPACE:username}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain} #EVENTID 4741 EVENTID\_4741 \s\*%{GREEDYDATA:action}.\sSubject%{GREEDYDATA} Account Name:%{NOTSPACE:username\_doing}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain\_doing}%{GREEDYDATA}New Computer Account:%{GREEDYDATA}Account Name:%{NOTSPACE:username}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain} #EVENTID 4743 EVENTID\_4743 \s\*%{GREEDYDATA:action}.\sSubject%{GREEDYDATA} Account Name:%{NOTSPACE:username\_doing}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain\_doing}%{GREEDYDATA}Target Computer:%{GREEDYDATA}Account Name:%{NOTSPACE:username}%{GREEDYDATA}Account Domain:%{NOTSPACE:account\_domain} #EVENTID 1033 1034 EVENTID\_1033\_1034 \s\*%{GREEDYDATA:action}.Product Name: %{GREEDYDATA:product}. Product Version:%{GREEDYDATA}error status:\s\*%{INT:status} #EVENTID 4727 4730 EVENTID\_4727\_4730 \s\*%{GREEDYDATA:action}.\s_Subject: Security%{GREEDYDATA}Account Name:\s_%{NOTSPACE:username\_doing}\s\*Account Domain:%{NOTSPACE:domain\_doing}%{GREEDYDATA}(New Group|Deleted Group):%{GREEDYDATA}Group Name:%{GREEDYDATA:group}Group Domain%{NOTSPACE:domain\_group} #EVENTID 4728 4729 4752 EVENTID\_4728\_4729\_4752 \s\*%{GREEDYDATA:action}.\s_Subject: Security%{GREEDYDATA}Account Name:\s_%{NOTSPACE:username\_doing}\s\*Account Domain:%{NOTSPACE:domain\_doing}%{GREEDYDATA}Member:%{GREEDYDATA}Account Name:(cn|CN)=%{GREEDYDATA:username},OU%{GREEDYDATA} Group Name:%{GREEDYDATA:group}Group Domain:%{NOTSPACE:domain\_group} ---
**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\ **Post date:** [December 6, 2018, 7:37pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/2 "2018-12-06T19:37:37Z")
Couple of things. Your logstash match option looks a bit odd to me. See the examples [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match). You dont need to be inserting "message" on each line...only once and then an array of patterns below it. Second...you have a lot of greedydata patterns...that slow things way down. You also should be using anchors in your pattern definitions. I also wonder if you could utilize the [dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) instead. You might want to check it out. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 6, 2018, 7:44pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/3 "2018-12-06T19:44:18Z")
As pointed out, a lot of your grok patterns look very, very inefficient as they use a lot of DATA and GREEDYDATA patterns. Have a look at [this blog post around optimising grok patterns](https://www.elastic.co/blog/do-you-grok-grok). ---
**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\ **Post date:** [December 6, 2018, 7:45pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/4 "2018-12-06T19:45:34Z")
Curious...are these events coming from Winlogbeat on an AD domain controller? If so, there may be an easier way to parse this using a custom pipeline if the events come through like param1, param2, etc. ---
**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\ **Post date:** [December 6, 2018, 8:04pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/5 "2018-12-06T20:04:01Z")
Thanks all, i will check the post that you sent to me and try to improve my regexs 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2019, 8:04pm UTC](https://discuss.elastic.co/t/logstash-multiple-match-patterns-increase-my-load-average/159792/6 "2019-01-03T20:04:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.