Severity: warning | Message: grok 'DATE_YMD' already registred | Log Parsers: schiz0phr3ne/prowlarr-logs, schiz0phr3ne/radarr-logs, schiz0phr3ne/sonarr-logs, Dominic-Wagner/vaultwarden-logs

[instantdreams]

Describe the bug
On start of crowdsec, the following warning messages are produced:

crowdsec  | time="2025-03-04T15:23:23-07:00" level=warning msg="grok 'DATE_YMD' already registred" id=ancient-breeze name=schiz0phr3ne/prowlarr-logs stage=s01-parse
crowdsec  | time="2025-03-04T15:23:23-07:00" level=warning msg="grok 'DATE_YMD' already registred" id=lively-resonance name=schiz0phr3ne/radarr-logs stage=s01-parse
crowdsec  | time="2025-03-04T15:23:23-07:00" level=warning msg="grok 'DATE_YMD' already registred" id=autumn-shadow name=schiz0phr3ne/sonarr-logs stage=s01-parse
crowdsec  | time="2025-03-04T15:23:23-07:00" level=warning msg="grok 'DATE_YMD' already registred" id=proud-surf name=Dominic-Wagner/vaultwarden-logs stage=s01-parse

To Reproduce
Add the following collections to crowdsec:

• schiz0phr3ne/prowlarr
• schiz0phr3ne/radarr
• schiz0phr3ne/sonarr
• Dominic-Wagner/vaultwarden

Add the following entries to acquis.yaml:

---
source: loki
url: http://[ip-address]:3100/
query: |
  {docker_container_name="prowlarr"}
limit: 1000
log_level: warn
labels:
  type: Prowlarr
---
source: loki
url: http://[ip-address]:3100/
query: |
  {docker_container_name="radarr"}
limit: 1000
log_level: warn
labels:
  type: Radarr
---
source: loki
url: http://[ip-address]:3100/
query: |
  {docker_container_name="sonarr"}
limit: 1000
log_level: warn
labels:
  type: Sonarr
---
source: loki
url: http://[ip-address]:3100/
query: |
  {docker_container_name="vaultwarden"}
limit: 1000
log_level: warn
labels:
  type: Vaultwarden

Expected behavior
No warning messages, or an explanation of the warning message.

Screenshots
n/a

Additional context
Raising this issue to help harden each log parser.

[LaurenceJJones]

Yes the issue is the grok patterns are shared between parsers even if the parser defines it own patterns they currently leak between them, we have a task in crowdsec to create a seperation between own patterns so this warning wont happen ever. However, for now the only workaround would be to modify each parser pattern to have a prefix EG: PROWLARR_DATE_YMD.

the warning is actually a problem if the pattern is different, however, they are not.

parsers/s01-parse/Dominic-Wagner/vaultwarden-logs.yaml:  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"
parsers/s01-parse/schiz0phr3ne/prowlarr-logs.yaml:  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"
parsers/s01-parse/schiz0phr3ne/radarr-logs.yaml:  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"
parsers/s01-parse/schiz0phr3ne/sonarr-logs.yaml:  DATE_YMD: "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}"

So either we update them or ignore the warnings for now till we update crowdsec to not leak them.