logstash-filter-grok icon indicating copy to clipboard operation
logstash-filter-grok copied to clipboard

Warn when patterns don't have anchors

Open jsvd opened this issue 6 years ago • 1 comments

Configuring grok patterns without putting anchors such as ^ (match to the beginning of the line) or $ (match the end of the line) can cause the regex engine to perform extra work in trying to match the input to the given pattern.

This leads to resource consumption and slower pipelines, as investigated in this blog post.

Logging a warning to users about patterns that aren't anchored could improve the overall performance of grok parsing.

jsvd avatar Oct 21 '19 23:10 jsvd

Valid anchors:

  • ^ beginning-of-line
  • $ end-of-line
  • \A start-of-input
  • \z end-of-input

yaauie avatar Oct 22 '19 00:10 yaauie