Logstash grok is a regex engine with a bad reputation

Grok is regular expressions with named patterns, and it earns its reputation honestly: a pattern that backtracks on an unexpected line will use an entire CPU and stall the pipeline behind it.

filter {
  grok {
    match => { "message" => "%{IPORHOST:client} %{WORD:verb} %{URIPATHPARAM:path} %{NUMBER:status:int}" }
    timeout_millis => 500
    tag_on_failure => ["_grokparsefailure"]
  }
}

timeout_millis is the setting that stops one malformed line taking the pipeline down, and it is not set by default. Anchor patterns and prefer the specific named ones over %{GREEDYDATA}, which is where the backtracking comes from. The better answer for anything you control is to emit JSON and use the json filter — grok is for logs somebody else formats.