Repository navigation
keycloak-logs grok pattern too broad #1908
Description
Describe the bug
keycloak:
image: quay.io/keycloak/keycloak:26.7
docker ps --format '{{.Names}}' | grep -i keycloak
keycloak-db
keycloak
cat /etc/crowdsec/acquis.d/keycloak.yaml
source: docker
container_name:
- keycloak
labels:
type: keycloak
---
The KEYCLOAK_LOG_LINE grok ([org.*]) matches any Keycloak logger, not just org.keycloak.events
Every non-audit line gets fed into the child node's ParseKV(), which fails since those lines aren't key=value formatted — logging level=error msg="could not find any key/value pair in line" for each one
On a real deployment, cscli parsers inspect inherent-io/keycloak-logs showed 3859/6540 hits (59%) unparsed
sudo journalctl -u crowdsec --since today |grep "level=error"
Sep 28 12:02:19 ip-3 crowdsec[1899234]: time="2026-09-28T12:02:19Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:08:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:08:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:08:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:08:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:12:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:12:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:21:50 ip-3 crowdsec[1899234]: time="2026-09-28T12:21:50Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:23:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:23:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:23:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:23:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:31:30 ip-3 crowdsec[1899234]: time="2026-09-28T12:31:30Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:38:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:38:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:38:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:38:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:38:25 ip-3 crowdsec[1899234]: time="2026-09-28T12:38:25Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:51:06 ip-3 crowdsec[1899234]: time="2026-09-28T12:51:06Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:53:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:53:05Z" level=error msg="could not find any key/value pair in line"
Sep 28 12:53:05 ip-3 crowdsec[1899234]: time="2026-09-28T12:53:05Z" level=error msg="could not find any key/value pair in line"
sudo cscli version
version: v1.8.1-debian-pragmatic-amd64-909b5157
Codename: alphaga
BuildDate: 2026-09-03_10:57:01
GoVersion: 1.26.3
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.8.1-debian-pragmatic-amd64-909b5157-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_kubernetes, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite
Activity
kobobear commentedon Sep 28, 2026
Proposed fix
Guard the ParseKV call so it only runs on lines that look like real audit events:
- filter: evt.Parsed.parsed_message contains "type=" && ParseKV(evt.Parsed.parsed_message, evt.Unmarshaled, "keycloak") in ["", nil]Tested against production traffic:
keycloak-bf,keycloak-slow-bf,keycloak-user-enum-bf, andkeycloak-user-enum-slow-bfall still receive and correctly process realLOGIN_ERRORevents after this changeConfirmed via
cscli explainand live bucket metrics — poured counts incrementing, overflows unaffectedNo noise, no regression
sabban commentedon Nov 13, 2026
Hi,
Thank you for your report. Can you provide such a logline that doesn't fit ParseKV ?
Regards,
kobobear commentedon Nov 13, 2026
2026-09-28 13:49:35,183 INFO [org.keycloak.http.access-log] (executor-thread-94) 203.0.113.10 - - [28/Sep/2026:13:49:35 +0000] "POST /realms/example/protocol/openid-connect/token HTTP/1.1" 200 3334