logstash-filter-grok
logstash-filter-grok copied to clipboard
Warn when patterns don't have anchors
Configuring grok patterns without putting anchors such as ^ (match to the beginning of the line) or $ (match the end of the line) can cause the regex engine to perform extra work in trying to match the input to the given pattern.
This leads to resource consumption and slower pipelines, as investigated in this blog post.
Logging a warning to users about patterns that aren't anchored could improve the overall performance of grok parsing.
Valid anchors:
-
^beginning-of-line -
$end-of-line -
\Astart-of-input -
\zend-of-input