{"record":{"id":"6e8a0361f51c4da6","repo":"crowdsecurity/crowdsec","slug":"failed-to-compile-grok-q-v","errorCode":null,"errorMessage":"failed to compile grok %q: %v","messagePattern":"failed to compile grok %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/grok.go","lineNumber":59,"sourceCode":"\n\t\trg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to find grok %q: %v\", g.RegexpName, err)\n\t\t}\n\n\t\tif rg.RunTimeRegexp == nil {\n\t\t\treturn nil, fmt.Errorf(\"empty grok %q\", g.RegexpName)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpName, rg.RunTimeRegexp.String())\n\t} else if g.RegexpValue != \"\" {\n\t\tif strings.HasSuffix(g.RegexpValue, \"\\n\") {\n\t\t\tlogger.Debugf(\"Beware, pattern ends with \\\\n: %q\", g.RegexpValue)\n\t\t}\n\n\t\trg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to compile grok %q: %v\", g.RegexpValue, err)\n\t\t}\n\n\t\tlogger.Tracef(\"%s regexp: %s\", g.RegexpValue, rg.RunTimeRegexp.String())\n\t}\n\n\t// if grok source is an expression\n\tif g.ExpValue != \"\" {\n\t\trg.RunTimeValue, err = expr.Compile(g.ExpValue,\n\t\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while compiling grok's expression: %w\", err)\n\t\t}\n\t}\n\n\t/* load grok statics */\n\t// compile expr statics if present\n\tfor _, static := range g.Statics {\n\t\tcompiled, err := static.Compile()","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/grok.go#L41-L77","documentation":"When a node's grok is given inline via RegexpValue instead of a name, Compile asks the grok store to compile that pattern string. Any compilation failure (bad grok syntax, unknown sub-pattern reference, unterminated construct) is wrapped as 'failed to compile grok'.","triggerScenarios":"Compile() calls pctx.Grok.Compile(g.RegexpValue) and the pattern fails to compile — e.g. referencing %{NONEXISTENT_PATTERN} or malformed grok syntax.","commonSituations":"Hand-written grok in a parser config with a typo'd pattern reference; pasted grok from another tool using macros not defined in crowdsec's pattern set; unbalanced %{...} constructs.","solutions":["Fix the pattern syntax in RegexpValue; verify every %{PATTERN} reference exists in the grok-patterns file.","Test the pattern with a tool like the grok debugger (grokev) or crowdsec's parser test (`cscli hub test`) to pinpoint the failing construct.","Fall back to a named grok if the inline pattern duplicates an existing one.","Check for unescaped regex metacharacters in the pasted pattern."],"exampleFix":"// before\ngrok:\n  value: \"(?P<target_foo>%{UNDEFINED_VAR})\"\n// after\ngrok:\n  value: \"(?P<target_foo>%{WORD})\"","handlingStrategy":"validation","validationCode":"// pre-compile candidate grok values before writing them into config\n_, err := grok.NewGlobalConfig().Compile(patternValue)\nif err != nil {\n    return fmt.Errorf(\"grok pattern %q invalid: %w\", patternValue, err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := node.Compile(pctx); err != nil {\n    if strings.Contains(err.Error(), \"failed to compile grok\") {\n        logger.Errorf(\"inline grok pattern broken; verify %%{PATTERN} references exist: %v\", err)\n    }\n    return err\n}","preventionTips":["Verify every %{PATTERN} in an inline grok exists in grok-patterns.yaml.","Test patterns with `cscli hub test` before shipping parser configs.","Prefer named groks over hand-written inline ones when a stock pattern exists.","Escape regex metacharacters when pasting patterns from other tools."],"tags":["parser","grok","regex","crowdsec"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}