# Value too large to output (49839 bytes) logstash error

**URL:** https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170
**Category:** Logstash
**Tags:** windows
**Created:** [January 12, 2022, 1:48pm UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170 "2022-01-12T13:48:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ZZ.IT](https://avatars.discourse-cdn.com/v4/letter/z/b38774/32.png) [@ZZ.IT](https://discuss.elastic.co/u/ZZ.IT)
#### Post date: [January 12, 2022, 1:48pm UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170/1 "2022-01-12T13:48:51Z")

</div>

We are using ELK stack on windows server 2016. ELK stack has version 7.16.2.

We are sending data from filebeat to logstash using pipeline and the pipeline har grok plugin.

On sending the data we are getting the error in logstash:

```auto
Timeout executing grok '(?<parsedtime>%{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{HOUR}:%{MINUTE}:%{SECOND})\s*\t%{DATA:process} \(%{DATA:processcode}\)\s*\t%{DATA:tid}\s*\t(?<area>[^\t]*)\s*\t(?<category>[^\t]*)\s*\t%{WORD:eventID}
\s*\t%{WORD:level}\s*\t(?<eventmessage>.*)\t%{UUID:CorrelationID}?' against field 'message' with value 'Value too large to output (49839 bytes)! First 255 chars are:

```

The pipeline configuration is:

```auto
if "GO ULS" in [tags] {
grok {
match => { "message" => "(?<parsedtime>%{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{HOUR}:%{MINUTE}:%{SECOND})\s*\t%{DATA:process} \(%{DATA:processcode}\)\s*\t%{DATA:tid}\s*\t(?<area>[^\t]*)\s*\t(?<category>[^\t]*)\s*\t%{WORD:eventID}
\s*\t%{WORD:level}\s*\t(?<eventmessage>.*)\t%{UUID:CorrelationID}?" }
}
date {
locale => "en"
match => ["parsedtime", "MM/dd/YYYY HH:mm:ss.SS"]
}
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 12, 2022, 2:14pm UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170/2 "2022-01-12T14:14:56Z")

</div>

Matching a pattern in grok can be really slow (resulting in a timeout) when the pattern fails to match. If you are trying to match the entire line then add ^ at the start of the pattern to anchor it to start of line. If you can replace any of those DATA with NOTSPACE that will also speed things up.

---

<div class="post-metadata">

### Author: ![ZZ.IT](https://avatars.discourse-cdn.com/v4/letter/z/b38774/32.png) [@ZZ.IT](https://discuss.elastic.co/u/ZZ.IT)
#### Post date: [January 13, 2022, 11:02am UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170/3 "2022-01-13T11:02:33Z")

</div>

Thanks a lot for your input, we have not changed it to GREEDYDATA

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 10, 2022, 11:02am UTC](https://discuss.elastic.co/t/value-too-large-to-output-49839-bytes-logstash-error/294170/4 "2022-02-10T11:02:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.