# Which algorithms are used in grok filter to find exact match?
**URL:** https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090
**Category:** Logstash
**Created:** [May 1, 2018, 6:27am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090 "2018-05-01T06:27:16Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [May 1, 2018, 6:27am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/1 "2018-05-01T06:27:17Z")
Hi all, I am using grok filter to find an exact match in logs. My logs size would be 10 mb. And streaming of logs is continuing going on. I am not getting that every time match is searched in 10 mb of log size Will it be good or not.
Algorithms used are efficient or not.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 1, 2018, 6:33am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/2 "2018-05-01T06:33:26Z")
It would help if you share your config and provide a more detailed description of what you are looking to do. Logstash by default processes the data in the log file line by line, so will not run grok against the full file.
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [May 1, 2018, 6:36am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/3 "2018-05-01T06:36:44Z")
@Christian_Dahlqvist here is the snapshot of logs
rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
[15119.753902] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753917] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753937] Dhd\_prot\_ioctl : bus is down. we have nothing to do
[15119.791431] [] (schedule\_timeout+0x158/0x25c) from [] (0xea1e0000)
[15119.799331] kworker/3:2 R running 0 29597 2 0x00000000
[15119.805699] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.814384] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.822637] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.830710] kworker/u8:1 S c0ab2fd4 0 29738 2 0x00000000
[15119.837078] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.845763] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.854015] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.862088] kworker/u8:4 S c0ab2fd4 0 29739 2 0x00000000
[15119.868455] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.877140] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.885391] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.893468] Sched Debug Version: v0.10, 3.10.96+ #1
[15119.898337] ktime
And filter used is
grok
{
match =\> { logs =\> "dhd\_check\_hang: Event HANG send up due to"}
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 1, 2018, 6:42am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/4 "2018-05-01T06:42:56Z")
What is the expected output/result?
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [May 1, 2018, 6:43am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/5 "2018-05-01T06:43:40Z")
expected output result is
[15119.753902] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753917] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 1, 2018, 6:45am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/6 "2018-05-01T06:45:51Z")
Are you looking to filter out all lines that does not match that pattern? What do you want the resulting document being sent to Elasticsearch to look like?
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [May 1, 2018, 6:47am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/7 "2018-05-01T06:47:58Z")
I am using grok filter to find regex match in logs and extract only those line and dumps these lines in ES
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 1, 2018, 6:58am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/8 "2018-05-01T06:58:09Z")
Would something like this work?
```auto
if [message] !~ /Dhd_check_hang: Event HANG send up due to/ {
drop {}
}
```
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [May 1, 2018, 7:11am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/9 "2018-05-01T07:11:37Z")
If it will check line by line then it will take more time to finad match and dump
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 1, 2018, 7:27am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/10 "2018-05-01T07:27:29Z")
> If it will check line by line then it will take more time to finad match and dump
Maybe. Have you measured?
The background of your questions is unclear. What are you getting at?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 29, 2018, 7:27am UTC](https://discuss.elastic.co/t/which-algorithms-are-used-in-grok-filter-to-find-exact-match/130090/11 "2018-05-29T07:27:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.