crowdsecurity/crowdsec · error

failed to compile grok %q: %v

Error message

failed to compile grok %q: %v

What it means

When a node's grok is given inline via RegexpValue instead of a name, Compile asks the grok store to compile that pattern string. Any compilation failure (bad grok syntax, unknown sub-pattern reference, unterminated construct) is wrapped as 'failed to compile grok'.

Source

Thrown at pkg/parser/grok.go:59

		rg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)
		if err != nil {
			return nil, fmt.Errorf("unable to find grok %q: %v", g.RegexpName, err)
		}

		if rg.RunTimeRegexp == nil {
			return nil, fmt.Errorf("empty grok %q", g.RegexpName)
		}

		logger.Tracef("%s regexp: %s", g.RegexpName, rg.RunTimeRegexp.String())
	} else if g.RegexpValue != "" {
		if strings.HasSuffix(g.RegexpValue, "\n") {
			logger.Debugf("Beware, pattern ends with \\n: %q", g.RegexpValue)
		}

		rg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)
		if err != nil {
			return nil, fmt.Errorf("failed to compile grok %q: %v", g.RegexpValue, err)
		}

		logger.Tracef("%s regexp: %s", g.RegexpValue, rg.RunTimeRegexp.String())
	}

	// if grok source is an expression
	if g.ExpValue != "" {
		rg.RunTimeValue, err = expr.Compile(g.ExpValue,
			exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
		if err != nil {
			return nil, fmt.Errorf("while compiling grok's expression: %w", err)
		}
	}

	/* load grok statics */
	// compile expr statics if present
	for _, static := range g.Statics {
		compiled, err := static.Compile()

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the pattern syntax in RegexpValue; verify every %{PATTERN} reference exists in the grok-patterns file.
2. Test the pattern with a tool like the grok debugger (grokev) or crowdsec's parser test (`cscli hub test`) to pinpoint the failing construct.
3. Fall back to a named grok if the inline pattern duplicates an existing one.
4. Check for unescaped regex metacharacters in the pasted pattern.

Example fix

// before
grok:
  value: "(?P<target_foo>%{UNDEFINED_VAR})"
// after
grok:
  value: "(?P<target_foo>%{WORD})"

// pre-compile candidate grok values before writing them into config
_, err := grok.NewGlobalConfig().Compile(patternValue)
if err != nil {
    return fmt.Errorf("grok pattern %q invalid: %w", patternValue, err)
}

if _, err := node.Compile(pctx); err != nil {
    if strings.Contains(err.Error(), "failed to compile grok") {
        logger.Errorf("inline grok pattern broken; verify %%{PATTERN} references exist: %v", err)
    }
    return err
}

When it happens

Trigger: Compile() calls pctx.Grok.Compile(g.RegexpValue) and the pattern fails to compile — e.g. referencing %{NONEXISTENT_PATTERN} or malformed grok syntax.

Common situations: Hand-written grok in a parser config with a typo'd pattern reference; pasted grok from another tool using macros not defined in crowdsec's pattern set; unbalanced %{...} constructs.

Related errors

• unable to find grok %q: %v
• empty grok %q
• while compiling grok's expression: %w
• no parser found. Please install the appropriate parser and r
• grok requires 'expression' or 'apply_on'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6e8a0361f51c4da6. Report an issue: GitHub.