# Runout error when parsing with logstash **URL:** \ **Category:** Logstash\ **Created:** [June 11, 2020, 4:45pm UTC](https://discuss.elastic.co/t/runout-error-when-parsing-with-logstash/236752 "2020-06-11T16:45:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![nb03briceno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nb03briceno/32/45777_2.png) [@nb03briceno](https://discuss.elastic.co/u/nb03briceno)\ **Post date:** [June 11, 2020, 4:45pm UTC](https://discuss.elastic.co/t/runout-error-when-parsing-with-logstash/236752/1 "2020-06-11T16:45:52Z")
Hello everyone, I'm trying to use logstash in order to parse some txt files. When doing it, one of the lines read from the txt file is really big, causing a problem in the grok parsing. A line of the txt file I'm talking about looks like this : slight\_smile: 2020-06-09 10:18:08,771 INFO BROKER-DS-DEFAULT-DB PermissionMappingBuilder: HMMBase: register mappings: {imc2.trx.order.monitor=load.Plugin.plugin.Orders Manager:load.Plugin.plugin.Over the Counter Orders Manager, imc2.trx.child\_order.monitor=load.Plugin.plugin.Oms Orders Manager, soa.admin=show.View.view.horizontrader.plugins.fmk2.permissions.views.PermissionsViewFactory:write.Database.db.Portfolio:write.Database.db.PortfolioProperty:write.Database.db.SSMPortfolio:write.Database.db.SSMPortfolioMapping:write.Database.db.SSMUser:write.Database.db.SSMSecurity:write.Database.db.SSMPosition:write.Database.db.DefaultPortfolio:write.Database.db.UserPortfolio:write.Database.db.License:write.Database.db.Context:write.Database.db.UserContext:write.Database.db.UserInfo:write.Database.db.AuditConfig:write.Database.db.Region:write.Database.db.Country:write.Database.db.Sector:write.Database.db.YesterdayPositionHistoric, imc2.trx.order=load.Plugin.plugin.Orders Manager:load.Plugin.plugin.Over the Counter Orders Manager:load.Plugin.plugin.Horizon Trader Ladder:load.Plugin.plugin.Excel Trading:load.Plugin.plugin.Order Batch:access.Action.action.Prepare bulk delete...:access.Action.action.Buy:access.Action.action.Sell:access.Action.action.Buy at Market:access.Action.action.Sell at Market:access.Action.action.Remove asks:access.Action.action.Remove BEST ask:access.Action.action.Remove BEST bid:access.Action.action.Remove bids:access.Action.action.Remove orders at selected depth:access.Action.action.Remove orders for instrument:access.Action.action.Prepare duplicate:access.Action.action.Send duplicate:access.Action.action.Remove orders (forced):access.Action.action.Prepare duplicate:access.Action.action.Send sell order:access.Action.action.Send buy order:access.Action.action.Prepare sell order (DEPRECATED).................................................................... ..................................................... .... So, and for that logstash is showing me the next error 🙂 timeout executing grok '%{TIMESTAMP\_ISO8601:logdate1} %{LOGLEVEL:logLevel} %{SPACE} %{DATA:processName} %{SPACE} %{DATA:Library} %{DATA:result3} %{DATA} %{DATA} %{DATA} %{DATA:userLogin} %{DATA:userId} %{WORD}=%{WORD:isServer} %{DATA} %{GREEDYDATA}' against field 'message' with value '2020-06-09 11:46:06,446 INFO Resource Checkup MemoryResourceCheckup: Memory check-up : \ \ \ \ \'! It is any suggestion you can give me to solve this issue?. It is possible to add a conditional in the parsing for the cases in which lines are too long? any recommendation is valuable, JUAN DAVID BRICENO GUERRERO MASTER STUDENT IN SUSTAINABLE INDUSTRIAL ENGINEERING ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 11, 2020, 8:38pm UTC](https://discuss.elastic.co/t/runout-error-when-parsing-with-logstash/236752/2 "2020-06-11T20:38:37Z")
The timeout occurs because of all the back-tracking that the use of multiple DATA elements that do not match. Can you use NOTSPACE instead? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 9, 2020, 8:38pm UTC](https://discuss.elastic.co/t/runout-error-when-parsing-with-logstash/236752/3 "2020-07-09T20:38:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.