elastic/elasticsearch · warning · RuntimeException

grok pattern matching was interrupted after [{}] ms

Error message

grok pattern matching was interrupted after [{}] ms

What it means

Thrown by Grok.handleInterrupted() when the joni Matcher returns Matcher.INTERRUPTED, meaning the MatcherWatchdog interrupted the regex matching operation after exceeding its configured maximum execution time. This prevents ReDoS (Regular Expression Denial of Service) attacks where catastrophic backtracking in complex grok patterns causes matching to hang. The exception is a RuntimeException (unchecked).

Source

Thrown at libs/grok/src/main/java/org/elasticsearch/grok/Grok.java:264

        }
        extracter.extract(utf8Bytes, offset, matcher.getEagerRegion());
        return true;
    }

    /**
     * The list of values that this {@linkplain Grok} can capture.
     */
    public List<GrokCaptureConfig> captureConfig() {
        return captureConfig;
    }

    public Regex getCompiledExpression() {
        return compiledExpression;
    }

    private void handleInterrupted(int result) {
        if (result == Matcher.INTERRUPTED) {
            throw new RuntimeException(
                "grok pattern matching was interrupted after [" + matcherWatchdog.maxExecutionTimeInMillis() + "] ms"
            );
        }
    }

    public static String combinePatterns(List<String> patterns) {
        return combinePatterns(patterns, null);
    }

    public static String combinePatterns(List<String> patterns, String traceMatchKey) {
        String combinedPattern;
        if (patterns.size() > 1) {
            combinedPattern = "";
            for (int i = 0; i < patterns.size(); i++) {
                String pattern = patterns.get(i);
                String valueWrap;
                if (traceMatchKey != null) {
                    valueWrap = "(?<" + traceMatchKey + "." + i + ">" + pattern + ")";

View on GitHub (pinned to db6a809a66)

Solutions

1. Increase the MatcherWatchdog timeout (matcherWatchdog.maxExecutionTimeInMillis) if the input legitimately requires more matching time.
2. Optimize the grok pattern to avoid catastrophic backtracking — anchor patterns, reduce ambiguous alternations, use possessive quantifiers if supported.
3. Pre-filter or truncate input text before applying grok matching if inputs can be extremely long.
4. Use MatcherWatchdog.noop() only in controlled environments where ReDoS is not a concern.

Example fix

// before — default or very short watchdog timeout
new Grok(bank, pattern, MatcherWatchdog.newInstance(100L), callback);

// after — increase timeout for complex patterns
new Grok(bank, pattern, MatcherWatchdog.newInstance(5000L), callback);

try {
    boolean matched = grok.match(text);
} catch (RuntimeException e) {
    if (e.getMessage().contains("interrupted after")) {
        // log and handle timeout — skip or truncate input
        logger.warn("Grok matching timed out for input of length " + text.length());
    }
    throw e;
}

When it happens

Trigger: Calling Grok.match(text), Grok.captures(text), or Grok.match(bytes, offset, length, extracter) with input text that triggers catastrophic backtracking in the compiled regex, exceeding the MatcherWatchdog's maxExecutionTimeInMillis. The watchdog is registered/unregistered around each matcher.search() call.

Common situations: Processing log lines with a grok pattern that has nested quantifiers or ambiguous alternations causing exponential backtracking on certain inputs; a sudden increase in log message length or format complexity; running with a very low watchdog timeout; processing adversarial or malformed input designed to trigger ReDoS.

Related errors

• Unable to find pattern [{}] in Grok's pattern dictionary
• circular reference in pattern back [{}]
• Can not convert grok patterns to regular expression
• unsupported ECS compatibility mode [{}]
• failed to load built-in patterns

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/afad5ad75e63d426. Report an issue: GitHub.