no parser found. Please install the appropriate parser and…

Error message

no parser found. Please install the appropriate parser and retry

What it means

LoadParserDump runs parser node tests from a parser dump file and needs at least one installed parser to select stages/parsers from. It returns this error when the collected parsers slice is empty, i.e. no parser is installed in the hub for the dump under test.

Solutions

Install parsers: cscli hub update && cscli collections install crowdsecurity/linux (or relevant collection)
Verify hub data with cscli hub list and cscli parsers list
Reinstall the hub data directory if it was deleted

Example fix

# before: empty hub
$ cscli parsers list   # -> no entries
# after
$ cscli hub update
$ cscli collections install crowdsecurity/linux

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("cscli", "parsers", "list", "-o", "json").Output()
if err != nil || strings.TrimSpace(string(out)) == "" || string(out) == "[]" {
    return errors.New("install parsers via cscli hub install before dumping")
}

Prevention

Run cscli hub update && install a collection during provisioning
Verify parsers exist before running parser dumps/tests
Alert on empty hub directories in CI/test environments

When it happens

Trigger: Calling LoadParserDump when no parsers are installed (cscli hub update/install never run or hub data removed), so parsers list is empty after sorting.

Common situations: Running crowdsec or cscli test/dump on a fresh install without `cscli hub install` of collections; wiped hub directory; offline install missing parsers.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/3cec7602405e7ed3. Report an issue: GitHub.

Appendix: source

Thrown at pkg/dumps/parser_dump.go:81

	// Loop over stages to find last successful one with at least one parser
	for i := len(stages) - 2; i >= 0; i-- {
		if len(pdump[stages[i]]) != 0 {
			lastStage = stages[i]
			break
		}
	}

	parsers := make([]string, 0, len(pdump[lastStage]))

	for k := range pdump[lastStage] {
		parsers = append(parsers, k)
	}

	sort.Strings(parsers)

	if len(parsers) == 0 {
		return nil, errors.New("no parser found. Please install the appropriate parser and retry")
	}

	lastParser := parsers[len(parsers)-1]

	for idx, result := range pdump[lastStage][lastParser] {
		if result.Evt.StrTime == "" {
			logger.Warningf("Line %d/%d is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.", idx, len(pdump[lastStage][lastParser]))
		} else {
			logger.Debugf("Line %d/%d has evt.StrTime set to '%s'", idx, len(pdump[lastStage][lastParser]), result.Evt.StrTime)
		}
	}

	return &pdump, nil
}

type tree struct {
	// note : we can use line -> time as the unique identifier (of acquisition)
	state       map[time.Time]map[string]map[string]ParserResult

View on GitHub (pinned to 909b515798)