crowdsecurity/crowdsec · error

error connecting to websocket

Error message

error connecting to websocket

What it means

The Loki client failed to establish the WebSocket connection used by the /loki/api/v1/tail endpoint. The underlying dial error is logged, and the tailer returns this generic error to the caller via the response channel of Tail().

Source

Thrown at pkg/acquisition/modules/loki/internal/lokiclient/loki_client.go:283

		dialer.Proxy = func(req *http.Request) (*url.URL, error) {
			req.SetBasicAuth(lc.config.Username, lc.config.Password)
			return nil, nil
		}
	}

	requestHeader := http.Header{}
	for k, v := range lc.requestHeaders {
		requestHeader.Add(k, v)
	}
	lc.Logger.Infof("Connecting to %s", u)

	conn, resp, err := dialer.Dial(u, requestHeader)
	if resp != nil && resp.Body != nil {
		_ = resp.Body.Close()
	}
	if err != nil {
		lc.Logger.Errorf("Error connecting to websocket, err: %s", err)
		return responseChan, errors.New("error connecting to websocket")
	}

	lc.t.Go(func() error {
		defer conn.Close()
		for {
			jsonResponse := &LokiResponse{}

			err = conn.ReadJSON(jsonResponse)
			if err != nil {
				lc.Logger.Errorf("Error reading from websocket: %s", err)
				return fmt.Errorf("websocket error: %w", err)
			}

			responseChan <- jsonResponse
		}
	})

	return responseChan, nil

View on GitHub (pinned to 909b515798)

Solutions

1. Check Loki is reachable: curl http://<host>:3100/ready, fix loki_url host/port
2. Verify sslDisposition/tls matches the server scheme (http vs https)
3. Inspect the preceding log line 'Error connecting to websocket' for the root cause
4. Confirm auth credentials/tenant headers if Loki requires them
5. Check firewalls/proxies allow the WebSocket upgrade

Example fix

// before
loki_url: http://localhost:3199
// after
loki_url: http://localhost:3100

resp, err := http.Get(lokiURL + "/ready")
if err != nil || resp.StatusCode != 200 {
    return errors.New("loki not reachable")
}

for {
    ch, err := client.Tail(ctx)
    if err != nil {
        log.Printf("loki tail failed: %v; retrying in 10s", err)
        time.Sleep(10 * time.Second)
        continue
    }
    break
}

When it happens

Trigger: dialer.Dial fails in Tail(): DNS failure, connection refused (Loki down or wrong port), TLS handshake failure with sslDisposition mismatch, proxy issues, or a non-101 HTTP response from the server.

Common situations: Loki not running, wrong loki_url/DSN host or port, HTTPS configured against a plain-HTTP Loki, auth required (401/403), or network/firewall blocking the upgrade request.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• websocket error: %w
• loki channel closed
• docker events connection failed: %w
• error querying range: %w
• loki query is mandatory

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/bc066962263682b4. Report an issue: GitHub.