Here is an earlier post about GROK performance with a solution that seems related:
There are a couple things that you can do to increase performance such as using NOTSPACE instead of DATA (if possible) and strictly defining the beginning (^) and end ($) of your GROK
