Timeout executing grok "Value too large to output (347 bytes)!"

Don't use so many DATA patterns. They are very expensive. Use more exact patterns. For example, if your tokens are delimited by spaces you can just use NOTSPACE instead.

I don't think I've ever seen a case where it has been warranted to have more than one DATA or GREEDYDATA pattern in the same expression.

1 Like