Check triggers for these items. If there are, for example, regex(5m,...) and item has thousands of values per second it will cause massive load for history syncer due to its internal logic.

Thanks for the hint. Yes we use 14 Triggers with 2 regex checks each on that logfile. Therefore 28 regex to eval on each logline. 

The goal is to monitor application state based on applications logoutput. What is the recommended way to achieve this? Is there another way to achieve this with zabbix?

Therefore 28 regex to eval on each logline.

If it is regex(<interval>, ...) and not regex(#<count>, ...) it is even worse. For every new log line Zabbix will apply regexp to every log line within <interval>, therefore load is proportional to number of lines per second squared.

Things to try:

1. optimize regular expressions themselves or even replace them with multiple str() functions;
2. consider using shorter interval or replace <interval> with #<count>;
3. offload regexp matching to the agent, make it send only important lines;
4. prevent "log storms" by limiting amount of lines agent is allowed to send per second.

By the way, there may be an improvement coming your way in the form of ZBX-15428.

Hi,
I'll be closing this issue as a clone of ZBX-15428.
Please adjust your expressions as described by Glebs.

The performance of regexp functions should also be improved in updates 4.0.4 and 4.2.0