crowdsecurity/crowdsec · critical

failed to load parser patterns: %w

Error message

failed to load parser patterns: %w

What it means

LoadParsers builds the main grok-parser context via NewUnixParserCtx, which loads the base regex pattern files (hive/hub patterns) for the parsers. If those pattern files are missing, unreadable, or malformed, parser initialization aborts and the cause is wrapped here.

Source

Thrown at pkg/parser/unix_parser.go:119

	sort.Slice(parsers.PovfwStageFiles, func(i, j int) bool {
		return parsers.PovfwStageFiles[i].Filename < parsers.PovfwStageFiles[j].Filename
	})

	return parsers
}

func LoadParsers(cConfig *csconfig.Config, hub *cwhub.Hub) (*Parsers, error) {
	var err error

	patternDir := cConfig.ConfigPaths.PatternDir
	log.Infof("Loading grok library %s", patternDir)

	parsers := NewParsers(hub)

	/* load base regexps for two grok parsers */
	parsers.Ctx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)
	if err != nil {
		return nil, fmt.Errorf("failed to load parser patterns: %w", err)
	}

	parsers.PovfwCtx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)
	if err != nil {
		return nil, fmt.Errorf("failed to load postovflw parser patterns: %w", err)
	}

	/*
		Load enrichers
	*/
	log.Info("Loading enrich plugins")

	parsers.EnricherCtx, err = Loadplugin()
	if err != nil {
		return nil, fmt.Errorf("failed to load enrich plugin: %w", err)
	}

	/*

View on GitHub (pinned to 909b515798)

Solutions

1. Check `config_paths.data_dir` in config.yaml points to the directory containing `patterns/`.
2. Run `cscli hub update && cscli hub install crowdsecurity/...` (or `cscli hub upgrade`) to install parser patterns.
3. Verify read permissions on the pattern files for the crowdsec user.
4. Inspect the wrapped error for the specific missing/invalid pattern file and fix or re-download it.

Example fix

// before (config.yaml)
config_paths:
  data_dir: /nonexistent/data
// after
config_paths:
  data_dir: /var/lib/crowdsec/data/

// before starting parsers, verify patterns exist
patternFiles, err := filepath.Glob(filepath.Join(patternDir, "*.txt"))
if err != nil || len(patternFiles) == 0 {
    return fmt.Errorf("no parser patterns in %q; run 'cscli hub update && cscli hub install'", patternDir)
}

parsers, err := LoadParsers(hub, cfg)
if err != nil {
    if strings.Contains(err.Error(), "failed to load parser patterns") {
        log.Error("patterns missing/corrupt: run 'cscli hub update' and check data_dir")
    }
    return err
}

When it happens

Trigger: initCrowdsec -> LoadParsers calls NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir); it errors when the pattern directory is empty, the pattern files (e.g. crowdsecurity/*.txt from the hub) are absent, or a pattern file cannot be parsed.

Common situations: DataDir misconfigured in config.yaml pointing to a nonexistent path; `cscli hub update`/`install` never ran so parser patterns are missing; permission problems on the data directory.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• failed to compile node '%s' in '%s' : %s
• failed to load postovflw parser patterns: %w
• failed to load parser config: %w
• no configuration paths provided
• compilation of '%s' context value failed: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/3da64ba77948134a. Report an issue: GitHub.