crowdsecurity/crowdsec · error

failed to load parser config: %w

Error message

failed to load parser config: %w

What it means

LoadStages parses the YAML parser configuration files (StageFiles) and compiles them into the parser node tree; LoadParsers wraps failures in "failed to load parser config". This means at least one parser YAML file is invalid — bad syntax, unknown fields, or a node that fails to compile (bad expression, missing stage). The wrapped error points at the offending file/node.

Source

Thrown at pkg/parser/unix_parser.go:145

	/*
		Load enrichers
	*/
	log.Info("Loading enrich plugins")

	parsers.EnricherCtx, err = Loadplugin()
	if err != nil {
		return nil, fmt.Errorf("failed to load enrich plugin: %w", err)
	}

	/*
	 Load the actual parsers
	*/

	log.Infof("Loading parsers from %d files", len(parsers.StageFiles))

	parsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)
	if err != nil {
		return nil, fmt.Errorf("failed to load parser config: %w", err)
	}

	if len(parsers.PovfwStageFiles) > 0 {
		log.Info("Loading postoverflow parsers")

		parsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, parsers.EnricherCtx)
		if err != nil {
			return nil, fmt.Errorf("failed to load postoverflow config: %w", err)
		}
	} else {
		log.Info("No postoverflow parsers to load")

		parsers.Povfwnodes = []Node{}
	}

	if cConfig.Prometheus != nil && cConfig.Prometheus.Enabled {
		parsers.Ctx.Profiling = true
		parsers.PovfwCtx.Profiling = true

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error for the exact file/line, then fix or remove that parser YAML under /etc/crowdsec/parsers/
2. Validate YAML syntax with `yamllint` or `cscli` before restarting
3. Run `cscli hub upgrade` to restore pristine hub parsers, and move custom parsers aside to bisect
4. Check `cscli parsers list -a` for broken/incompatible parser collections

Example fix

// before (custom parser file)
filter: 'evt.Parsed.program == 'sshd''   # nested quotes
// after
filter: evt.Parsed.program == 'sshd'

import "gopkg.in/yaml.v3"
func validYAML(path string) error {
  b, err := os.ReadFile(path); if err != nil { return err }
  var m map[string]any
  return yaml.Unmarshal(b, &m)
}

parsers, err := parser.LoadParsers(cfg)
if err != nil {
  if strings.Contains(err.Error(), "failed to load parser config") {
    log.Fatalf("invalid parser yaml, fix file named in: %v", err)
  }
  return err
}

When it happens

Trigger: LoadStages(parsers.StageFiles, ...) returning an error during LoadParsers — a .yaml file in config/parsers/s*/ is unparseable YAML, references an unknown format, or has a bad filter expression.

Common situations: Hand-edited parser file with wrong indentation; custom parser installed from the hub that conflicts or has a typo; leftover partially-written file after a failed `cscli hub upgrade`; a parser targeting a newer crowdsec format version.

Related errors

• failed to load postovflw parser patterns: %w
• failed to load postoverflow config: %w
• no configuration paths provided
• cannot parse: %s
• while parsing '%s': %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/85c2775d2e5cc24f. Report an issue: GitHub.