{"record":{"id":"693585bc06d4443e","repo":"crowdsecurity/crowdsec","slug":"empty-grok-q","errorCode":null,"errorMessage":"empty grok %q","messagePattern":"empty grok %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/grok.go","lineNumber":48,"sourceCode":"\tRunTimeValue   *vm.Program    // the actual compiled filter\n\tRuntimeStatics []RuntimeStatic\n}\n\nfunc (g *GrokPattern) Compile(pctx *UnixParserCtx, logger *log.Entry) (*RuntimeGrokPattern, error) {\n\tvar err error\n\n\trg := &RuntimeGrokPattern{}\n\t/* load grok by name or compile in-place */\n\tif g.RegexpName != \"\" {\n\t\tlogger.Tracef(\"+ Regexp Compilation %q\", g.RegexpName)\n\n\t\trg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to find grok %q: %v\", g.RegexpName, err)\n\t\t}\n\n\t\tif rg.RunTimeRegexp == nil {\n\t\t\treturn nil, fmt.Errorf(\"empty grok %q\", g.RegexpName)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpName, rg.RunTimeRegexp.String())\n\t} else if g.RegexpValue != \"\" {\n\t\tif strings.HasSuffix(g.RegexpValue, \"\\n\") {\n\t\t\tlogger.Debugf(\"Beware, pattern ends with \\\\n: %q\", g.RegexpValue)\n\t\t}\n\n\t\trg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to compile grok %q: %v\", g.RegexpValue, err)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpValue, rg.RunTimeRegexp.String())\n\t}\n\n\t// if grok source is an expression\n\tif g.ExpValue != \"\" {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/grok.go#L30-L66","documentation":"After a named grok lookup succeeds without error, Compile double-checks that the returned pattern is non-nil. A nil regexp for a non-empty RegexpName is an internal inconsistency (registry returned nothing usable), surfaced as 'empty grok'.","triggerScenarios":"Compile() gets a nil RunTimeRegexp back from pctx.Grok.Get(g.RegexpName) despite err == nil — e.g. the grok store holds an empty/degenerate entry under that name.","commonSituations":"A corrupted or hand-edited grok patterns file defines a pattern with an empty body; a locally overridden pattern file blanked out a standard grok.","solutions":["Inspect the grok pattern definition for that name in the patterns file; fix or remove the empty definition.","Restore a pristine grok-patterns.yaml via `cscli hub update` and remove local overrides that blank the pattern.","Report upstream if stock hub patterns yield an empty compiled grok."],"exampleFix":"// before (patterns file)\nMY_GROK\n// after\nMY_GROK (?:%{IP:src_ip})","handlingStrategy":"validation","validationCode":"// ensure the pattern file entry is non-empty before use\npattern, ok := patternFile[name]\nif !ok || strings.TrimSpace(pattern) == \"\" {\n    return fmt.Errorf(\"grok %q has an empty pattern body\", name)\n}","typeGuard":null,"tryCatchPattern":"if err := node.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"empty grok\") {\n        logger.Errorf(\"grok registry returned empty pattern; check local patterns overrides: %v\", err)\n    }\n    return err\n}","preventionTips":["Don't hand-edit grok pattern files; let `cscli hub update` manage them.","Review local patterns overrides for accidentally blanked entries.","Keep pattern files versioned/diff-checked when customizing."],"tags":["parser","grok","crowdsec"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}