I finished up work on the pattern discovery feature for the C++ port of grok. As soon as it was finished, I wanted to see the dpeed differences between the perl and C++ versions.

• Perl grok: 6 lines analyzed per second
• C++ grok: 130 lines analyzed per second

The feature tested here was the one detailed in this post.

130 lines per second isn't fantastic, but it's 21.66 times faster than the perl version, and that's huge.

I still have to implement a few other features to make the C++ version equivalent to the perl version:

• config file (same format, ideally, as the perl version)
• filters, like %SYSLOGDATE|parsedate%