# Logstash spikes to ~800% when adding one more GROK expression? **URL:** \ **Category:** Logstash\ **Created:** [March 21, 2016, 9:15am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966 "2016-03-21T09:15:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Mark\_Rodman](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Post date:** [March 21, 2016, 9:15am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/1 "2016-03-21T09:15:15Z")
Hi All, I'm suffering a strange issue when trying to process IDS events with Logstash. My events are essentially , delimited as follows; 2016-03-11T22:18:48.559342+00:00 1457648327 2016-03-11T22:18:48.538761+00:00 1457648327 ukloninfosecsfs01 SFIDSXYSC: Protocol: TCP, SrcIP: 10.10.10.10, DstIP: 10.10.10.11, SrcPort: 88, DstPort: 21586, TCPFlags: 0x0, IngressInterface: s3p4, IngressZone: MASKEDvalue, DE: Primary Detection Engine (352b0534-b660-11e4-b7f2-efa234d91272), Policy: XY BO Remote, ConnectType: End, AccessControlRuleName: BO General, AccessControlRuleAction: Allow, UserName: No Authentication Required, InitiatorPackets: 4, ResponderPackets: 0, InitiatorBytes: 256, ResponderBytes: 0, DNSResponseType: No Error, Sinkhole: Unknown, URLCategory: Unknown, URLReputation: Risk unknown All IDS events contain the following prefix format. 2016-03-11T22:18:48.559342+00:00 1457648327 2016-03-11T22:18:48.538761+00:00 1457648327 ukloninfosecsfs01 SFIDSXYSC: Protocol: TCP, SrcIP: 10.10.10.10, DstIP: 10.10.10.11, SrcPort: 88, DstPort: 21586, TCPFlags: 0x0, IngressInterface: s3p4, IngressZone: MASKEDvalue, DE: Primary Detection Engine (352b0534-b660-11e4-b7f2-efa234d91272), Policy: XY BO Remote, ConnectType: End, AccessControlRuleName: BO General, AccessControlRuleAction: Allow, UserName: No Authentication Required, And only the section after this tends to change with a small variety of additional fields being inserted dependant on protocol/client etc. I have written my GROK as follows; ^\S+\s\S+\s%{TIMESTAMP\_ISO8601:time\_3}\s\S+\s(?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:\s+\w+:\s+%{WORD:protocol},\s\w+:\s+%{IP:src\_ip},\s+\w+:\s+%{IP:dst\_ip},\s+\w+:\s+%{INT:src\_port},\s+\w+:\s%{INT:dst\_port},\s+\w+:\s%{BASE16NUM:tcpflags},\s+\w+:\s%{WORD:ingress\_interface},\s+\w+:\s+%{WORD:ingress\_zone},\s+\w+:\s+(?[^,]+),\s+\w+:\s%{DATA:policy},\s+\w+:\s%{DATA:connect\_type},\s+\w+:\s%{DATA:access\_control\_rule\_name},\s+\w+:\s%{DATA:access\_control\_rule\_action},\sUserName:\s%{DATA:username},\s+InitiatorPackets:\s%{INT:initiator\_packets},\s+ResponderPackets:\s%{INT:responder\_packets},\s+InitiatorBytes:\s%{INT:initiator\_bytes},\s+ResponderBytes:\s%{INT:responder\_bytes}, Note I have defined some of the above as patterns to reduce the complexity within my .conf files. The patterns have been removed here. The above works well and processes a significant number of EPS. The above only matches to the point ResponderBytes: 0, If I append \_s+DNSResponseType:\s%{DATA:DNSRespType},\_ the CPU spikes to 800% and nothing is processed. This is one example. There is a number of other variations I’ve tried however essentially I cannot progress by adding another matched field. I can’t see why one more field would seemly take down logstash. Data is being feed into Elastic. I’ve trying tuning work threads, logstash heap etc. Your help would be most appreciated. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 21, 2016, 9:22am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/2 "2016-03-21T09:22:14Z")
> [@Mark\_Rodman](#): > > SFIDSXYSC: It looks to me like everything after this is a sequence of key-value pairs. You might be able to use grok to parse the fields before this and capture this key-value list in a single field and apply the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) instead. ---
**Author:** ![Mark\_Rodman](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Post date:** [March 21, 2016, 10:57am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/3 "2016-03-21T10:57:46Z")
Thanks for the guidance, To be honest KV isn't a filter I've used before. I've been experimenting following your post, but I'm struggling to manage whitespace in my 'Values'. KV will spot each of my Keys with ease but trims at the first whitespace. Is there a trick I'm missing? Examples. "URLReputation" =\> "Risk" , It should be "URLReputation" =\> "Risk unknown" "DE" =\> "Primary", it should be "DE" =\> "Primary Detection Engine (352b0534-b660-11e4-b7f2-efa234d91272)" Thanks ---
**Author:** ![Mark\_Rodman](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Post date:** [March 21, 2016, 11:01am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/4 "2016-03-21T11:01:14Z")
Having just posted that, I swapped the KV separator to = and then used filter { grok { match =\> [ "message" , "^\S+\s\S+\s%{TIMESTAMP\_ISO8601:time\_3}\s\S+\s(?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:\s+%{GREEDYDATA:pending}" ] } ``` kv { source => "pending" field_split => "," } ``` } This solved the whitespace issue. I need to combine that with the correct ':' delimiter now. ---
**Author:** ![Mark\_Rodman](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Post date:** [March 21, 2016, 11:04am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/5 "2016-03-21T11:04:02Z")
Sorted, kv { source =\> "pending" field\_split =\> "," value\_split =\> ":" } Thanks for the help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966/6 "2017-07-06T05:06:07Z")