Hello everyone,
I'm trying to use logstash in order to parse some txt files. When doing it, one of the lines read from the txt file is really big, causing a problem in the grok parsing. A line of the txt file I'm talking about looks like this : slight_smile:
2020-06-09 10:18:08,771 INFO BROKER-DS-DEFAULT-DB PermissionMappingBuilder: HMMBase: register mappings: {imc2.trx.order.monitor=load.Plugin.plugin.Orders Manager:load.Plugin.plugin.Over the Counter Orders Manager, imc2.trx.child_order.monitor=load.Plugin.plugin.Oms Orders Manager, soa.admin=show.View.view.horizontrader.plugins.fmk2.permissions.views.PermissionsViewFactory:write.Database.db.Portfolio:write.Database.db.PortfolioProperty:write.Database.db.SSMPortfolio:write.Database.db.SSMPortfolioMapping:write.Database.db.SSMUser:write.Database.db.SSMSecurity:write.Database.db.SSMPosition:write.Database.db.DefaultPortfolio:write.Database.db.UserPortfolio:write.Database.db.License:write.Database.db.Context:write.Database.db.UserContext:write.Database.db.UserInfo:write.Database.db.AuditConfig:write.Database.db.Region:write.Database.db.Country:write.Database.db.Sector:write.Database.db.YesterdayPositionHistoric, imc2.trx.order=load.Plugin.plugin.Orders Manager:load.Plugin.plugin.Over the Counter Orders Manager:load.Plugin.plugin.Horizon Trader Ladder:load.Plugin.plugin.Excel Trading:load.Plugin.plugin.Order Batch:access.Action.action.Prepare bulk delete...:access.Action.action.Buy:access.Action.action.Sell:access.Action.action.Buy at Market:access.Action.action.Sell at Market:access.Action.action.Remove asks:access.Action.action.Remove BEST ask:access.Action.action.Remove BEST bid:access.Action.action.Remove bids:access.Action.action.Remove orders at selected depth:access.Action.action.Remove orders for instrument:access.Action.action.Prepare duplicate:access.Action.action.Send duplicate:access.Action.action.Remove orders (forced):access.Action.action.Prepare duplicate:access.Action.action.Send sell order:access.Action.action.Send buy order:access.Action.action.Prepare sell order (DEPRECATED)....................................................................
.....................................................
....
So, and for that logstash is showing me the next error 
timeout executing grok '%{TIMESTAMP_ISO8601:logdate1} %{LOGLEVEL:logLevel} %{SPACE} %{DATA:processName} %{SPACE} %{DATA:Library} %{DATA:result3} %{DATA} %{DATA} %{DATA} %{DATA:userLogin} %{DATA:userId} %{WORD}=%{WORD:isServer} %{DATA} %{GREEDYDATA}' against field 'message' with value '2020-06-09 11:46:06,446 INFO Resource Checkup MemoryResourceCheckup: Memory check-up : <max 8028 Mb> <nonHeap 68 Mb> <total 604 Mb> <free 368 Mb> <consumed 236 Mb>'!
It is any suggestion you can give me to solve this issue?. It is possible to add a conditional in the parsing for the cases in which lines are too long?
any recommendation is valuable,
JUAN DAVID BRICENO GUERRERO
MASTER STUDENT IN SUSTAINABLE INDUSTRIAL ENGINEERING