I have the following grok pattern :
that sets syslog.message from a GREEDYDATA pattern; and after a little while (depends on how much RAM you give to LS) GC time will become longer and longer, JVM will become unresponsive and will finally throw exception.
Note that the following pattern :
does NOT presents the same behaviour
Also works; it consumes more memory (as expected), and thus creates more GC runs, but does not seem to leak.