Parse Failure slows down entire agent

[galvinograd]

When logstash fails to parse a large log file with a large grok parse template, it slows down the entire agent's performance significantly. On the other hand, when the parsing succeeds, logstash is orders of magnitude faster.
Maybe it has something to do with exception handling?

[electrical]

Hi,

For LS 1.5 we have improved the way the Grok filter works and improved the performance by about 2.5 times.
Do you have an example log line and pattern we can test it out with ?

Cheers.

[galvinograd]

Sadly no... :(

[suyograo]

@galvinograd Any more information you can add like log line, grok config would be helpful here.

[jordansissel]

We'll need a bit more information to go on. How do you observe the slowdown? Why do you think some kind of exceptions are the cause?

[jordansissel]

For Logstash 1.5.0, we've moved all plugins to individual repositories, so I have moved this issue to logstash-plugins/logstash-filter-grok#41. Let's continue the discussion there! :)