# Timeout executing grok using pipe symbol

**URL:** <https://discuss.elastic.co/t/timeout-executing-grok-using-pipe-symbol/176684>\
**Category:** Logstash\
**Created:** [April 12, 2019, 5:48pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-using-pipe-symbol/176684 "2019-04-12T17:48:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nowens95](https://avatars.discourse-cdn.com/v4/letter/n/9dc877/32.png) [@nowens95](https://discuss.elastic.co/u/nowens95)\
**Post date:** [April 12, 2019, 5:48pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-using-pipe-symbol/176684/1 "2019-04-12T17:48:12Z")

</div>

Hey all,

I'm getting a grok timeout warning with a very specific format of log. Here is my grok filter:

```
grok {
  match => { "message" => "fs_log: %{TIMESTAMP_ISO8601:timestamp} \|\| %{UNIXPATH:filename} \|\| %{WORD:caller} \|\| %{NUMBER:lineno} \|\| %{DATA:message} \|\| %{WORD:event} \|\| %{WORD:module} \|\| %{NOTSPACE:instance_id}" }
  overwrite => ["message"]
  keep_empty_captures => true
  add_tag => ["fs_log"]
}

```

As you can see, I am using two pipes `||` to delineate the fields to be parsed by grok.  
This works the vast majority of the time. However, there are two instances where I consistently get a grok timeout:

```
fs_log: 2019-04-12 17:28:24.434573 || /path/file.py || func_name || 338 || Subprocess call Failed: ERROR 2: CPLRealloc(): Out of memory allocating 423383040 bytes.
fs_log: 2019-04-12 17:28:29.940564 || /path/file.py || func_name || 338 || Subprocess call Failed: ERROR 2: ogrlinestring.cpp, 446: cannot allocate 732672016 bytes

```

These lines are obviously not supposed to match regardless, but then why is there a timeout? Here is a sample message of the warning:

```
[2019-04-12T17:31:21,999][WARN][logstash.filters.grok] Timeout executing grok 'fs_log: %{TIMESTAMP_ISO8601:timestamp} \|\| %{UNIXPATH:filename} \|\| %{WORD:caller} \|\| %{NUMBER:lineno} \|\| %{DATA:message} \|\| %{WORD:event} \|\| %{WORD:module} \|\| %{NOTSPACE:instance_id}' against field 'message' with value 'fs_log: 2019-04-12 17:28:29.940564 || /path/file.py || func_name || 338 || Subprocess call Failed: ERROR 2: ogrlinestring.cpp, 446: cannot allocate 732672016 bytes'!

```

And just to clarify, logstash is running on a different machine than the one that generates the log, so the fact that the log references memory allocation issues has nothing to do with the grok timeout.

Any help would be greatly appreciated!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 12, 2019, 6:08pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-using-pipe-symbol/176684/2 "2019-04-12T18:08:24Z")

</div>

UNIXPATH is [notoriously expensive](https://github.com/logstash-plugins/logstash-patterns-core/issues/159). Do not use it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2019, 6:08pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-using-pipe-symbol/176684/3 "2019-05-10T18:08:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.