C
CrowdSecβ€’2mo ago
LaserSeahorse

Traefik access log is read but not parsed

I cannot get crowdsec to parse the traefik access.log I've mounted into it's container. I'm using the crowdsecurity/traefik collection which came with the crowdsecurity/traefik-logs parser (v1.2) 
crowdsec:/# cat /etc/crowdsec/acquis.d/traefik.yaml
filenames:
  - /var/log/traefik/access.log
labels:
  type: traefik
crowdsec:/# cat /etc/crowdsec/acquis.d/traefik.yaml
filenames:
  - /var/log/traefik/access.log
labels:
  type: traefik
crowdsec:/# cscli metrics -o json
{
 "acquisition": {
  "file:/var/log/traefik/access.log": {
   "reads": 1809,
   "unparsed": 1809
  }
 },
crowdsec:/# cscli metrics -o json
{
 "acquisition": {
  "file:/var/log/traefik/access.log": {
   "reads": 1809,
   "unparsed": 1809
  }
 },
crowdsec:/# tail -n 1 var/log/traefik/access.log | cscli explain -f- --type traefik -v
WARNING Line 0/1 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  file=/tmp/cscli_explain2985532515/parser-dump.yaml
line: {"ClientAddr":"10.127.21.40:52025","ClientHost":"10.127.21.40","ClientPort":"52025","ClientUsername":"-","DownstreamContentSize":14,"DownstreamStatus":404,"Duration":5726712,"OriginContentSize":14,"OriginDuration":2928477,"OriginStatus":404,"Overhead":2798235,"RequestAddr":"home.<redacted>","RequestContentSize":0,"RequestCount":2108,"RequestHost":"home.<redacted>","RequestMethod":"GET","RequestPath":"/api/ios/config","RequestPort":"-","RequestProtocol":"HTTP/3.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"home-assistant-short-secure@docker","ServiceAddr":"10.127.30.100:8123","ServiceName":"home-assistant-short@docker","ServiceURL":"http://10.127.30.100:8123","StartLocal":"2025-10-19T22:15:02.429406257+11:00","StartUTC":"2025-10-19T11:15:02.429406257Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"web-secure","level":"info","msg":"","time":"2025-10-19T22:15:02+11:00"}
    β”œ s01-parse
    |    β”œ πŸ”΄ crowdsecurity/appsec-logs
    |    β”” πŸ”΄ crowdsecurity/traefik-logs
    β””-------- parser failure πŸ”΄
crowdsec:/# tail -n 1 var/log/traefik/access.log | cscli explain -f- --type traefik -v
WARNING Line 0/1 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  file=/tmp/cscli_explain2985532515/parser-dump.yaml
line: {"ClientAddr":"10.127.21.40:52025","ClientHost":"10.127.21.40","ClientPort":"52025","ClientUsername":"-","DownstreamContentSize":14,"DownstreamStatus":404,"Duration":5726712,"OriginContentSize":14,"OriginDuration":2928477,"OriginStatus":404,"Overhead":2798235,"RequestAddr":"home.<redacted>","RequestContentSize":0,"RequestCount":2108,"RequestHost":"home.<redacted>","RequestMethod":"GET","RequestPath":"/api/ios/config","RequestPort":"-","RequestProtocol":"HTTP/3.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"home-assistant-short-secure@docker","ServiceAddr":"10.127.30.100:8123","ServiceName":"home-assistant-short@docker","ServiceURL":"http://10.127.30.100:8123","StartLocal":"2025-10-19T22:15:02.429406257+11:00","StartUTC":"2025-10-19T11:15:02.429406257Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"web-secure","level":"info","msg":"","time":"2025-10-19T22:15:02+11:00"}
    β”œ s01-parse
    |    β”œ πŸ”΄ crowdsecurity/appsec-logs
    |    β”” πŸ”΄ crowdsecurity/traefik-logs
    β””-------- parser failure πŸ”΄
And the traefik config: 
accessLog:
  filePath: /var/log/traefik/access.log
  format: json
  filters:
    statusCodes:
      - "400-499"
      - "500-599"
accessLog:
  filePath: /var/log/traefik/access.log
  format: json
  filters:
    statusCodes:
      - "400-499"
      - "500-599"
2 Replies
CrowdSec
CrowdSecβ€’2mo ago
Important Information
This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve
© Created By WhyAydan for CrowdSec ❀️
CrowdSec
CrowdSecβ€’2mo ago
Resolving Traefik access log is read but not parsed This has now been resolved. If you think this is a mistake please run /unresolve

Did you find this page helpful?