Skip to content

fix(keycloak-logs): guard ParseKV to prevent errors on non-audit lines (#1908) - #1993

Open
hrithiksaini99 wants to merge 1 commit into
crowdsecurity:masterfrom
hrithiksaini99:fix-keycloak-log-filter
Open

hrithiksaini99 wants to merge 1 commit into
crowdsecurity:masterfrom
hrithiksaini99:fix-keycloak-log-filter

Conversation

@hrithiksaini99

Copy link
Copy Markdown
Contributor

Fixes #1908.

Description

The KEYCLOAK_LOG_LINE grok pattern (\[org.*\]) matches any Keycloak logger output, not just org.keycloak.events. Non-audit lines (such as Infinispan, container lifecycle, thread pool, and cluster log entries) were passed directly to ParseKV(), which failed because those lines do not contain key-value pairs, generating errors in logs:

level=error msg="could not find any key/value pair in line"

This change guards ParseKV in parsers/s01-parse/inherent-io/keycloak-logs.yaml by checking evt.Parsed.parsed_message contains "type=" before calling ParseKV. Because expressions short-circuit, non-audit lines bypass ParseKV completely while real audit events (type=LOGIN_ERROR, etc.) are parsed as expected without noise or regressions.

@sabban

sabban commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Hi,

Please keep the PR form.

Add a non-event [org.*] line to the keycloak-logs test, then regenerate parser.assert.

Regards,

@sabban sabban added the waiting-for-user Waiting for submitter answer regarding specific points in the PR label Nov 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

waiting-for-user Waiting for submitter answer regarding specific points in the PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

keycloak-logs grok pattern too broad

2 participants