crowdsecurity/crowdsec · error

loki channel closed

Error message

loki channel closed

What it means

During the tail loop, the channel delivering Loki websocket responses was closed without an error, which is treated as an abnormal termination. The source logs a warning and returns this error so crowdsec can restart or report the datasource failure.

Source

Thrown at pkg/acquisition/modules/loki/run.go:103

		if err := l.Client.Ready(readyCtx); err != nil {
			return fmt.Errorf("loki is not ready: %w", err)
		}
	}

	ll := l.logger.WithField("websocket_url", l.lokiWebsocket)

	t.Go(func() error {
		ctx, cancel := context.WithCancel(ctx)
		defer cancel()

		respChan := l.Client.QueryRange(ctx, true)

		for {
			select {
			case resp, ok := <-respChan:
				if !ok {
					ll.Warnf("loki channel closed")
					return errors.New("loki channel closed")
				}

				for _, stream := range resp.Data.Result {
					for _, entry := range stream.Entries {
						l.readOneEntry(entry, l.Config.Labels, out)
					}
				}
			case <-t.Dying():
				return nil
			}
		}
	})

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Check earlier logs for the websocket error that closed the channel and fix connectivity to Loki
2. Ensure Loki's tail stream isn't cut by proxies (raise idle timeouts)
3. Restart/reload crowdsec so the datasource reconnects
4. Upgrade if this recurs on every Loki restart (reconnect behavior)

// ensure Loki is up and tail endpoint responds before streaming
resp, err := http.Get(lokiURL + "/loki/api/v1/tail?query=" + url.QueryEscape(q))
if err != nil {
    return err
}
resp.Body.Close()

respChan, err := tail()
if err != nil { return err }
for resp := range respChan {
    _ = resp
}
// on closed channel: reconnect with backoff

When it happens

Trigger: The loki client goroutine closed respChan (e.g. after a fatal websocket read error or shutdown) while the run loop in Run() was still reading from it.

Common situations: Loki server closed the tail connection (restart, timeout, proxy idle cutoff) or an internal client error caused the channel producer to exit.

Related errors

• error connecting to websocket
• websocket error: %w
• loki query is mandatory
• delay_for should be a value between 1s and 5s
• empty loki host

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/07f803c2079d9d68. Report an issue: GitHub.