# Timeout executing grok "Value too large to output (347 bytes)!"
**URL:** https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123
**Category:** Logstash
**Created:** [August 15, 2017, 3:25pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123 "2017-08-15T15:25:24Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nfplatzke](https://discuss.elastic.co/u/nfplatzke)
#### Post date: [August 15, 2017, 3:25pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123/1 "2017-08-15T15:25:24Z")
OK I have been googling this and I can't figure it out at all. Every other person who is having this issue is dealing with large documents. The log messages I am indexing are pretty small and I'm still getting this error. I have tried everything I can think of but I can't fix this. Any help?
This is the exact message I'm getting:
Timeout executing grok '%{DATA:id} %{DATA:bucket} [%{S3WEBSITE\_DATETIME:datetime}] %{IP:sourceIP} %{DATA:requester} %{DATA:requestID} %{DATA:operation} %{DATA:key} "%{DATA:requestURI}" %{DATA:status} %{DATA:error} %{INT:bytesSent} %{INT:objectSize} %{INT:totalTime} %{INT:turnAroundTime} "%{DATA:referrer}" "%{DATA:userAgent}" %{DATA:versionID}' against field 'message' with value 'Value too large to output (347 bytes)! First 255 chars are: 05b4cf0437aaff5ef42be6981904b7eb4f1e0d62074f2eacd31da3f1431fac87 [websiteurl.com](http://websiteurl.com) [15/Aug/2017:14:37:16 +0000] 162.158.78.78 - 6FD33A5306435C5F WEBSITE.GET.OBJECT index.html "GET / HTTP/1.1" 304 - - 875 23 - "-" "Mozilla/5.0 (Macintosh; Intel Mac'!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2017, 7:11pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123/2 "2017-08-15T19:11:36Z")
Don't use so many DATA patterns. They are very expensive. Use more exact patterns. For example, if your tokens are delimited by spaces you can just use NOTSPACE instead.
I don't think I've ever seen a case where it has been warranted to have more than one DATA or GREEDYDATA pattern in the same expression.
---
### Author:  [@nfplatzke](https://discuss.elastic.co/u/nfplatzke)
#### Post date: [August 17, 2017, 3:15pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123/3 "2017-08-17T15:15:09Z")
I changed the patterns and this is no longer happening.
I feel like this should be called out in huge red text int he documentation of grok patterns.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2017, 3:15pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output-347-bytes/97123/4 "2017-09-14T15:15:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.