# Timeout executing grok & Value too large to output
**URL:** https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400
**Category:** Logstash
**Created:** [August 9, 2017, 8:51am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400 "2017-08-09T08:51:59Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 9, 2017, 8:51am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/1 "2017-08-09T08:51:59Z")
Hello,
I've already read a lot about that problem but I really don't know what to do precisely.
I'm using ELK 5.4.1 since a week now and after adding some grok filters, there is a tons of Timeout on my logstash-plain.log.
> [2017-08-09T10:28:00,898][WARN][logstash.filters.grok] Timeout executing grok '%{DATA:date}\sDEBUG%{DATA:body}\s-\scategory=%{GREEDYDATA:category}' against field 'message' with value 'Value too large to output (25308 bytes)! First 255 chars are: 2017-08-09 10:19:43,388 DEBUG [http-nio-8080-exec-1533] [com.services.aggregator.ServicesAggregationStrategy] - oldJson={"3":{"id":"3","name":"small data","layer\_info\_url":"an url'!
The grok filter is :
> message","%{DATA:date}\sDEBUG%{DATA:body}\s-\scategory=%{GREEDYDATA:category}",
The problem is my CPU usage wich is at 99%.
Could you helped me, to understand what's the problem ? My grok filter ? The configuration (have been done with bitnami) ?
Thanks by advance,
Slop
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2017, 9:17am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/2 "2017-08-09T09:17:08Z")
DATA and GREEDYDATA patterns are very expensive. Switch to something more specific (perhaps NOTSPACE?). It's extremely rare to have to use more than one DATA or GREEDYDATA in the same grok expression.
---
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 9, 2017, 9:40am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/3 "2017-08-09T09:40:29Z")
Thanks for that answer @magnusbaeck, I've just updated grok filter done by someone else to fetch "category".
Everything else on the grok filter is trash for me, what should I do to fetch "category" attribut and ignore everything else ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2017, 9:43am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/4 "2017-08-09T09:43:45Z")
What does a log entry look like? What fields (and values) do you want to extract?
---
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 9, 2017, 9:54am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/5 "2017-08-09T09:54:47Z")
The log look like :
> 2017-08-09 11:53:14,895 DEBUG [http-nio-8080-exec-1571] [com.services.processor.SolrDistributionsRoutePreprocessor] - category=report
And I just want to extract **category=report**
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2017, 10:06am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/6 "2017-08-09T10:06:45Z")
In that case I suppose `\scategory=%{GREEDYDATA:category}` should work.
---
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 9, 2017, 12:18pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/7 "2017-08-09T12:18:33Z")
Ok, it work, but in some case, there's data after category=report. And with ur solution, I fetch all those data, but I only want category=report.
Is there a solution for that ? To just fetch category=report and ignore everything else ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2017, 1:12pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/8 "2017-08-09T13:12:52Z")
You can use NOTSPACE instead of GREEDYDATA, assuming the category string won't ever contain a space.
---
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 9, 2017, 1:27pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/9 "2017-08-09T13:27:30Z")
It didn't work, here's an exemple :
> 2017-08-09 09:06:31,884 INFO [http-nio-8080-exec-1357] [com.client.AbstractClient] - Client url is [http://localhost:8080/services/search/distributions?mtd\_id=658874115&category=block&object\_type\_list=["basin"%2C"company"%2C"country"]&fq=distributions.id%3Ablock-100000237163&\_=1502258193028](http://localhost:8080/services/search/distributions?mtd_id=658874115&category=block&object_type_list=%5B%22basin%22%2C%22company%22%2C%22country%22%5D&fq=distributions.id%3Ablock-100000237163&_=1502258193028)
with this filter : category=%{NOTSPACE:category}
The result is :
> {
> "category": [
> [
> "block&object\_type\_list=%5B%22basin%22%2C%22company%22%2C%22country%22%5D&fq=distributions.id%3Ablock-100000237163&\_=1502258193028"
> ]
> ]
> }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2017, 6:48pm UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/10 "2017-08-09T18:48:25Z")
I don't have time to help out with new suggestions if you keep on changing the text you want to match.
---
### Author:  [@Slop](https://discuss.elastic.co/u/Slop)
#### Post date: [August 10, 2017, 10:08am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/11 "2017-08-10T10:08:31Z")
I'm sorry but I havn't post all the different case I had... because they are many.
Something I don't understand is, with grok debugger ([https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)) the results look ok.
But the render on kibana isn't .
Here's a full exemple :
my log
> 2017-08-10 11:46:00,185 INFO [http-nio-8080-exec-1998] [com.api.client.AbstractClient] - Client url is [http://localhost:8080/services/search/distributions?mtd\_id=-report-4774489&category=report&object\_type\_list=["basin"%2C"block"%2C"country"%2C"field"%2C"well"]&fq=distributions.id%3Aesearch-report-696807&\_=1502353506766](http://localhost:8080/services/search/distributions?mtd_id=-report-4774489&category=report&object_type_list=%5B%22basin%22%2C%22block%22%2C%22country%22%2C%22field%22%2C%22well%22%5D&fq=distributions.id%3Aesearch-report-696807&_=1502353506766)
my filter
> &category=%{NOTSPACE:category}&object\_type\_list=%{GREEDYDATA:trash}
The grok debugger result
> {
> "category": [
> [
> "report"
> ]
> ],
> "trash": [
> [
> "%5B%22basin%22%2C%22block%22%2C%22country%22%2C%22field%22%2C%22well%22%5D&fq=distributions.id%3Aeureka-esearch-report-696807&\_=1502353506766"
> ]
> ]
> }
And the kibana result
> report&object\_type\_list=%5B%22basin%22%2C%22block%22%2C%22country%22%2C%22field%22%2C%22well%22%5D&fq=distributions.id%3Aeureka-esearch-report-696807&\_=1502353506766
I really don't understand ....
But thanks for your help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2017, 10:08am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400/12 "2017-09-07T10:08:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.