# Time out executing grok

**URL:** <https://discuss.elastic.co/t/time-out-executing-grok/149232>\
**Category:** Logstash\
**Created:** [September 20, 2018, 6:18am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232 "2018-09-20T06:18:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![qloun](https://avatars.discourse-cdn.com/v4/letter/q/ce73a5/32.png) [@qloun](https://discuss.elastic.co/u/qloun)\
**Post date:** [September 20, 2018, 6:18am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/1 "2018-09-20T06:18:10Z")

</div>

Hello, I have problem with getting timeout executing grok. what I have learn that the value exceed limit. the error " Timeout executing grok against 'message' with value 'Value too large to output (1006 bytes)! First 255 chars are: "

here is the sample of the log (there are 13 point that i want to get and maybe the last point can be exclude)

// 1 **Sep 18 14:54:36** 2 **hostname** 3 **microsoft-windows-security-audit** 4 **4624** 5 **An account was successfully logged on**. Subject:Security ID:S-1-0-0Account Name:6\*\*- **Account Domain:7** - **Logon ID:0x0Logon Type:3New Logon:Security ID:S-1-5-21-1496626984-4026086081-1346473819-1199Account Name:8** - **Account Domain:9** - **Logon ID:0xbd421db9dLogon GUID:{00000000-0000-0000-0000-000000000000}Process Information:Process ID:0x0Process Name:-Network Information:Workstation Name:10** - **Source Network Address:11** - **Source Port:12** - **Detailed Authentication Information:13** Logon Process:NtLmSsp Authentication Package:NTLMTransited Services:-Package Name (NTLM only):NTLM V2Key Length:128This event is generated when a logon session is created. Itis generated on the computer that was accessed.The subject fields indicate the account on the local systemwhich requested the logon. This is most commonly a servicesuch as the Server service, or a local process such asWinlogon.exe or Services.exe.The\*\*

and for the grok+regex that i made

// match =\> { "message" =\> "%{SYSLOGTIMESTAMP:windows\_timestamp} %{SYSLOGHOST:windows\_hostname} (?\<windows\_service\>\S+) %{POSINT:windows\_eventid} (?\<windows\_event\>.+?()|.))(.+?:.+?:.+?:)(?\<windows\_accname\>.+?)(A.+?:)(?\<windows\_accdomain\>.+?)(L.+?:.+?:.+?:.+?:)(?\<windows\_accName\>.+)(A.+?:)(?\<windows\_accDomain\>.+)(L.+?:.+:.+?:.+?:.+?:.+?:)(?\<windows\_workstation\>.+)(S.+?:)(?\<windows\_srcip\>.+)(S.+?:)(?\<windows\_srcport\>.+)(D.+?:)%{GREEDYDATA:windows\_message}" }

Any help would be greatly appreciated. Thanks in advanced

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2018, 6:31am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/2 "2018-09-20T06:31:18Z")

</div>

The problem is your overuse of `.*` and `.+` (including GREEDYDATA). It's extremely inefficient and from what I can tell completely unnecessary. Pick more specific expressions and you'll be fine. Or could you even use a kv filter here? It looks like a consistently delimited list of key/value pairs.

---

<div class="post-metadata">

**Author:** ![qloun](https://avatars.discourse-cdn.com/v4/letter/q/ce73a5/32.png) [@qloun](https://discuss.elastic.co/u/qloun)\
**Post date:** [September 20, 2018, 7:54am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/3 "2018-09-20T07:54:50Z")

</div>

I've never used kv filter but I will try it later. But right now i had new problem, it says

`logstash[20341]: [833B blob data]`

do you know what it means?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2018, 8:14am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/4 "2018-09-20T08:14:00Z")

</div>

Is that it? No other messages in the surrounding context?

---

<div class="post-metadata">

**Author:** ![qloun](https://avatars.discourse-cdn.com/v4/letter/q/ce73a5/32.png) [@qloun](https://discuss.elastic.co/u/qloun)\
**Post date:** [September 20, 2018, 8:53am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/5 "2018-09-20T08:53:40Z")

</div>

nope, I run "service logstash status" and it show that message and my logstash stop sending log to my elastic.

edited. its running now. there's a problem in my grok and now its running.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2018, 8:53am UTC](https://discuss.elastic.co/t/time-out-executing-grok/149232/6 "2018-10-18T08:53:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.