Timeout executing grok error on LS docker container

Elastic Stack Logstash
1

I'm running a docker container using LS 6.5.4, but in the docker logs I am getting these errors

Timeout executing grok '%{USERNAME:level}: ?%{PATH:file} %{NUMBER:line_num} %{GREEDYDATA:kvpairs}' against field 'message' with value 'INFO: --> GET https://URL_REMOVED_FOR_SECURITY/news-en/query?version=2018-08-01&query=publication_date%3E%3Dnow-18hours,publication_date%3Cnow-16hours&count=50&offset=4650 http/1.1'!
Timeout executing grok '%{USERNAME:level}: ?%{PATH:file} %{NUMBER:line_num} %{GREEDYDATA:kvpairs}' against field 'message' with value 'INFO: <-- 200 OK https://URL_REMOVED_FOR_SECURITY/news-en/query?version=2018-08-01&query=publication_date%3E%3Dnow-18hours,publication_date%3Cnow-16hours&count=50&offset=4700 (1236ms, unknown-length body)'!

One solution I believe would be possibly increasing the heap in the jvm options, but is there a way to do that witohut using docker-compose? I need to use ansible to set the container up.

2

I do not believe increasing the heap would help. PATH is an defined as '(?:%{UNIXPATH}|%{WINPATH})', UNIXPATH is know to have severe performance issues. You will need to write a more efficient regexp. What are the lines you are trying to match?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.