{"record":{"id":"590bff775da47a4f","repo":"crowdsecurity/crowdsec","slug":"unable-to-find-grok-q-v","errorCode":null,"errorMessage":"unable to find grok %q: %v","messagePattern":"unable to find grok %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/grok.go","lineNumber":44,"sourceCode":"type RuntimeGrokPattern struct {\n\tConfig *GrokPattern\n\n\tRunTimeRegexp  grokky.Pattern // the actual regexp\n\tRunTimeValue   *vm.Program    // the actual compiled filter\n\tRuntimeStatics []RuntimeStatic\n}\n\nfunc (g *GrokPattern) Compile(pctx *UnixParserCtx, logger *log.Entry) (*RuntimeGrokPattern, error) {\n\tvar err error\n\n\trg := &RuntimeGrokPattern{}\n\t/* load grok by name or compile in-place */\n\tif g.RegexpName != \"\" {\n\t\tlogger.Tracef(\"+ Regexp Compilation %q\", g.RegexpName)\n\n\t\trg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to find grok %q: %v\", g.RegexpName, err)\n\t\t}\n\n\t\tif rg.RunTimeRegexp == nil {\n\t\t\treturn nil, fmt.Errorf(\"empty grok %q\", g.RegexpName)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpName, rg.RunTimeRegexp.String())\n\t} else if g.RegexpValue != \"\" {\n\t\tif strings.HasSuffix(g.RegexpValue, \"\\n\") {\n\t\t\tlogger.Debugf(\"Beware, pattern ends with \\\\n: %q\", g.RegexpValue)\n\t\t}\n\n\t\trg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to compile grok %q: %v\", g.RegexpValue, err)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpValue, rg.RunTimeRegexp.String())","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/grok.go#L26-L62","documentation":"When a parser node's grok specifies RegexpName (a named grok pattern), Compile looks it up in the parser context's grok collection (pctx.Grok.Get). If the name is not in the loaded grok patterns, the lookup error is wrapped as 'unable to find grok' and node compilation fails.","triggerScenarios":"Compile() is called for a node whose Grok.RegexpName references a pattern absent from the grok registry built from the hub's grok-patterns file (or builtin patterns).","commonSituations":"A custom parser config references a grok name that doesn't exist (typo, wrong case); grok-patterns file is missing/outdated in the hub data dir; a collection was installed without its grok pattern dependency.","solutions":["Fix the grok name in the parser YAML to one defined in the hub's grok-patterns file (check spelling/case with `cscli hub list` / the patterns file).","Run `cscli hub update` / `cscli hub upgrade` to refresh grok-patterns.yaml in the data directory.","If using a custom pattern, add it to /etc/crowdsec/config/patterns/ (or the local grok-patterns override) so it is registered.","Verify the collection providing the pattern is installed."],"exampleFix":"// before (parser yaml)\ngrok: { name: \"MY_CUSTOM_GROK\" }\n// after: use an existing pattern or define it locally\ngrok: { name: \"HTTPD_COMMONLOG\" }","handlingStrategy":"validation","validationCode":"grokNames := pctx.Grok.Names() // or parse grok-patterns file\nfor _, node := range nodes {\n    if node.Grok != nil && node.Grok.RegexpName != \"\" {\n        if !slices.Contains(grokNames, node.Grok.RegexpName) {\n            return fmt.Errorf(\"grok %q not defined\", node.Grok.RegexpName)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"compiled, err := node.Compile(pctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"unable to find grok\") {\n        logger.Errorf(\"parser references a missing grok pattern; run 'cscli hub update' or fix the name: %v\", err)\n    }\n    return err\n}","preventionTips":["Reference only grok names present in the hub's grok-patterns file; verify spelling and case.","Run `cscli hub update` after installs/upgrades so patterns are current.","Define any custom patterns locally before referencing them in parser configs.","Use `cscli hub test` to validate parser configs before deploying."],"tags":["parser","grok","config","crowdsec"],"backgroundTag":"resource-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}