crowdsecurity/crowdsec · error

unable to find grok %q: %v

Error message

unable to find grok %q: %v

What it means

When a parser node's grok specifies RegexpName (a named grok pattern), Compile looks it up in the parser context's grok collection (pctx.Grok.Get). If the name is not in the loaded grok patterns, the lookup error is wrapped as 'unable to find grok' and node compilation fails.

Source

Thrown at pkg/parser/grok.go:44

type RuntimeGrokPattern struct {
	Config *GrokPattern

	RunTimeRegexp  grokky.Pattern // the actual regexp
	RunTimeValue   *vm.Program    // the actual compiled filter
	RuntimeStatics []RuntimeStatic
}

func (g *GrokPattern) Compile(pctx *UnixParserCtx, logger *log.Entry) (*RuntimeGrokPattern, error) {
	var err error

	rg := &RuntimeGrokPattern{}
	/* load grok by name or compile in-place */
	if g.RegexpName != "" {
		logger.Tracef("+ Regexp Compilation %q", g.RegexpName)

		rg.RunTimeRegexp, err = pctx.Grok.Get(g.RegexpName)
		if err != nil {
			return nil, fmt.Errorf("unable to find grok %q: %v", g.RegexpName, err)
		}

		if rg.RunTimeRegexp == nil {
			return nil, fmt.Errorf("empty grok %q", g.RegexpName)
		}

		logger.Tracef("%s regexp: %s", g.RegexpName, rg.RunTimeRegexp.String())
	} else if g.RegexpValue != "" {
		if strings.HasSuffix(g.RegexpValue, "\n") {
			logger.Debugf("Beware, pattern ends with \\n: %q", g.RegexpValue)
		}

		rg.RunTimeRegexp, err = pctx.Grok.Compile(g.RegexpValue)
		if err != nil {
			return nil, fmt.Errorf("failed to compile grok %q: %v", g.RegexpValue, err)
		}

		logger.Tracef("%s regexp: %s", g.RegexpValue, rg.RunTimeRegexp.String())

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the grok name in the parser YAML to one defined in the hub's grok-patterns file (check spelling/case with `cscli hub list` / the patterns file).
2. Run `cscli hub update` / `cscli hub upgrade` to refresh grok-patterns.yaml in the data directory.
3. If using a custom pattern, add it to /etc/crowdsec/config/patterns/ (or the local grok-patterns override) so it is registered.
4. Verify the collection providing the pattern is installed.

Example fix

// before (parser yaml)
grok: { name: "MY_CUSTOM_GROK" }
// after: use an existing pattern or define it locally
grok: { name: "HTTPD_COMMONLOG" }

grokNames := pctx.Grok.Names() // or parse grok-patterns file
for _, node := range nodes {
    if node.Grok != nil && node.Grok.RegexpName != "" {
        if !slices.Contains(grokNames, node.Grok.RegexpName) {
            return fmt.Errorf("grok %q not defined", node.Grok.RegexpName)
        }
    }
}

compiled, err := node.Compile(pctx)
if err != nil {
    if strings.Contains(err.Error(), "unable to find grok") {
        logger.Errorf("parser references a missing grok pattern; run 'cscli hub update' or fix the name: %v", err)
    }
    return err
}

When it happens

Trigger: Compile() is called for a node whose Grok.RegexpName references a pattern absent from the grok registry built from the hub's grok-patterns file (or builtin patterns).

Common situations: A custom parser config references a grok name that doesn't exist (typo, wrong case); grok-patterns file is missing/outdated in the hub data dir; a collection was installed without its grok pattern dependency.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• empty grok %q
• failed to compile grok %q: %v
• while compiling grok's expression: %w
• onsuccess %q not continue,next_stage
• failed to compile node in '%s' : %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/590bff775da47a4f. Report an issue: GitHub.