# Simple grok filter blocking Logstash

**URL:** <https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262>\
**Category:** Logstash\
**Created:** [May 2, 2018, 2:22pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262 "2018-05-02T14:22:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [May 2, 2018, 2:22pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262/1 "2018-05-02T14:22:00Z")

</div>

Hi,

I just created the following grok filter and it causes Logstash to go totally berserk. It produces lots of load until it ultimately stops working. Sometimes one or another logevent comes through but they keep piling up in the redis buffer I installed between pipelines. The host is a CentOS 7 with openJDK 8, 2 cores and 4 gb Ram (with Logstash using 2gb)

Fewer than 20 hosts are only sending their system logs so it's only 30-140 events per minute. Very few other filters are active (it's a new setup) and Logstash is doing fine when I remove the file this filter is in. I copy the whole file so you see there's no other filter in it.

```auto
filter {
  if [program] == "setroubleshoot" {
    if [message] =~ /^SELinux is preventing/ {
      grok {
        match => ["message","SELinux is preventing %{UNIXPATH:application} from %{WORD:typeofaccess} access on the %{WORD:filetype} %{UNIXPATH:filename} For complete SELinux messages. run sealert -l %{NOTSPACE:sealertmessage}"]
        id => "setroubleshootprevent"
        add_tag => ["setroubleshootprevent","grokked"]
        tag_on_failure => ["_grokparsefailure","setroubleshootprevent_failed"]
      }
    }
  }
}

```

The pattern is an early version and may not be perfect but it should not be bad enough to block Logstash. I'm using Logstash 6.2.4 and tried to update `grok` but it seems there is no new version available.

Can you help me?  
Cheers,  
Thomas

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 2, 2018, 2:26pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262/2 "2018-05-02T14:26:30Z")

</div>

[This](https://github.com/logstash-plugins/logstash-patterns-core/issues/159) might be the issue. Do not use UNIXPATH.

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [May 2, 2018, 2:29pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262/3 "2018-05-02T14:29:58Z")

</div>

Whoa... this is weird. Thank you - I will give it a try and give feedback.

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [May 2, 2018, 2:39pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262/4 "2018-05-02T14:39:00Z")

</div>

You were right. This was the solution. Thanks for helping me out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2018, 2:39pm UTC](https://discuss.elastic.co/t/simple-grok-filter-blocking-logstash/130262/5 "2018-05-30T14:39:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.