crowdsecurity/crowdsec · error

empty grok %q

Error message

empty grok %q

What it means

After a named grok lookup succeeds without error, Compile double-checks that the returned pattern is non-nil. A nil regexp for a non-empty RegexpName is an internal inconsistency (registry returned nothing usable), surfaced as 'empty grok'.

Source

Thrown at pkg/parser/grok.go:48

	RunTimeValue   *vm.Program    // the actual compiled filter
	RuntimeStatics []RuntimeStatic
}

func (g *GrokPattern) Compile(pctx *UnixParserCtx, logger *log.Entry) (*RuntimeGrokPattern, error) {
	var err error

	rg := &RuntimeGrokPattern{}
	/* load grok by name or compile in-place */
	if g.RegexpName != "" {
		logger.Tracef("+ Regexp Compilation %q", g.RegexpName)

		rg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)
		if err != nil {
			return nil, fmt.Errorf("unable to find grok %q: %v", g.RegexpName, err)
		}

		if rg.RunTimeRegexp == nil {
			return nil, fmt.Errorf("empty grok %q", g.RegexpName)
		}

		logger.Tracef("%s regexp: %s", g.RegexpName, rg.RunTimeRegexp.String())
	} else if g.RegexpValue != "" {
		if strings.HasSuffix(g.RegexpValue, "\n") {
			logger.Debugf("Beware, pattern ends with \\n: %q", g.RegexpValue)
		}

		rg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)
		if err != nil {
			return nil, fmt.Errorf("failed to compile grok %q: %v", g.RegexpValue, err)
		}

		logger.Tracef("%s regexp: %s", g.RegexpValue, rg.RunTimeRegexp.String())
	}

	// if grok source is an expression
	if g.ExpValue != "" {

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the grok pattern definition for that name in the patterns file; fix or remove the empty definition.
2. Restore a pristine grok-patterns.yaml via `cscli hub update` and remove local overrides that blank the pattern.
3. Report upstream if stock hub patterns yield an empty compiled grok.

Example fix

// before (patterns file)
MY_GROK
// after
MY_GROK (?:%{IP:src_ip})

// ensure the pattern file entry is non-empty before use
pattern, ok := patternFile[name]
if !ok || strings.TrimSpace(pattern) == "" {
    return fmt.Errorf("grok %q has an empty pattern body", name)
}

if err := node.Validate(); err != nil {
    if strings.Contains(err.Error(), "empty grok") {
        logger.Errorf("grok registry returned empty pattern; check local patterns overrides: %v", err)
    }
    return err
}

When it happens

Trigger: Compile() gets a nil RunTimeRegexp back from pctx.Grok.Get(g.RegexpName) despite err == nil — e.g. the grok store holds an empty/degenerate entry under that name.

Common situations: A corrupted or hand-edited grok patterns file defines a pattern with an empty body; a locally overridden pattern file blanked out a standard grok.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• unable to find grok %q: %v
• failed to compile grok %q: %v
• while compiling grok's expression: %w
• no parser found. Please install the appropriate parser and r
• grok requires 'expression' or 'apply_on'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/693585bc06d4443e. Report an issue: GitHub.