Logstash spikes cpu @100% on grok parse failure about logstash-filter-grok HOT 3 CLOSED

The problem is likely that the use of GREEDYDATA doesn't inform the execution about how to match your data efficiently. You can read more about this kind of phenomenon on what Wikipedia calls ReDoS. Basically, my recommendation is to use the most specific patterns you can, and GREEDYDATA is not very specific (It will match anything or nothing), and such ambiguity can cause the regular expression engine to get bogged down trying to match things.

from logstash-filter-grok.

I do believe this to be an example of a pathological regexp that causes your parsing to be so slow or simply appear to be doing nothing but consuming 100% cpu.

from logstash-filter-grok.

closing this.
two notes about this issue in particular:

1. having two consecutive %{GREEDYDATA} patterns makes no sense. if your matching string is something like Once upon a time, there was a mouse., then the first GREEDYDATA will consume "Once upon a time, there was a", and the second will be "mouse." There's no way for the regex engine to figure out where to start and stop each GREEDYDATA, so it gives as much as possible to the first one.
2. adding guards to the regex makes parse failure much faster (2x to 5x in this case).

from logstash-filter-grok.