Grok parsing causes thread hang at 100%CPU


Starting in 1.1.0beta8 logstash begins to intermittently hang during grok parsing holding a thread at 100% of a CPU core. After several minutes or so the thread will die off before hanging again. During the thread hang nothing is processed.

Beta7 does not appear to have this behavior. Over 2 million lines processed without a halt.

Attached is a ps aux -L and a jstack of the process. It's hanging on LWP 17000; 4268 in hex under jstack. Also attached is my collector.conf and patterns file. It is the cfserver or cfusion pattern causing this, though I haven't been able to identify what specific line(s) are causing the hang. If you need more info or some sample log lines please contact me on IRC: colon_D #logstash.


Logstash Developers


Greg Dallavalle


Fix versions

Affects versions