# Crowdsec Gotify Parser not Work

**URL:** <https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572>\
**Category:** Uncategorized\
**Created:** [December 27, 2023, 8:56pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572 "2023-12-27T20:56:52Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 27, 2023, 8:56pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/1 "2023-12-27T20:56:52Z")

</div>

Hello,  
I installed Crowdsec and installed the baudneo/gotify collection. I have adjusted the path from the log in the acquis.yaml:

```auto
filenames:
  - /var/log/gotify/gotify.log
labels:
  type: gotify
---
journalctl_filter:
 - _SYSTEMD_UNIT=ssh.service
labels:
  type: syslog
---

```

If I log in incorrectly on Gotify WEBUI, it will also be in the Gotify log:

```auto
2023-12-27T20:32:28Z | 401 | 757.293 s | xxx.xxx.xxx.xxx | POST "/client"
Error #01: you need to provide a valid access token or user credentials to access this api

```

But Crowdsec won’t recognize it. Does anyone know where the error is, how can I test it? With SSH, crowdsec detects if I log in incorrectly and then blocks me local. (I have delete the Whitlist).

Here ist Information about Crowdsec:

 ![Screenshot (3)](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/0ac23002d8c30717165316df93cdbde36b072155.png)  
 ![Screenshot (2)](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/d87e216825ca913ece0db03a94e17c1190222939.png)  
 ![Screenshot (1)](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/a458968e50500e13978536668ee69ef9bb3eb0bf.png)

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [December 27, 2023, 10:25pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/2 "2023-12-27T22:25:01Z")

</div>

Gotify used to use Gin default log format, however, recently they have updated the format and it no longer matches ours.

Edit: just created a PR to update this [Gotify update by LaurenceJJones · Pull Request #899 · crowdsecurity/hub · GitHub](https://github.com/crowdsecurity/hub/pull/899)

Here is your log line parsed with the new parser

```auto
$ cscli explain --log '2023-12-27T20:32:28Z | 401 | 757.293s | 1.2.3.4 | POST "/client"' --type gotify -v
line: 2023-12-27T20:32:28Z | 401 | 757.293s | 1.2.3.4 | POST "/client"
	├ s00-raw
	|	├ 🟢 crowdsecurity/non-syslog (+5 ~8)
	| ├ update evt.ExpectMode : %!s(int=0) -> 1
	| ├ update evt.Stage : -> s01-parse
	| ├ update evt.Line.Raw : -> 2023-12-27T20:32:28Z | 401 | 757.293s | 1.2.3.4 | POST "/client"
	| ├ update evt.Line.Src : -> /tmp/cscli_explain1952543944/cscli_test_tmp.log
	| ├ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-12-28 09:41:49.126497829 +0000 UTC
	| ├ create evt.Line.Labels.type : gotify
	| ├ update evt.Line.Process : %!s(bool=false) -> true
	| ├ update evt.Line.Module : -> file
	| ├ create evt.Parsed.program : gotify
	| ├ create evt.Parsed.message : 2023-12-27T20:32:28Z | 401 | 757.293s | 1.2.3.4 | POST "/client"
	| ├ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2023-12-28 09:41:49.12651933 +0000 UTC
	| ├ create evt.Meta.datasource_path : /tmp/cscli_explain1952543944/cscli_test_tmp.log
	| ├ create evt.Meta.datasource_type : file
	├ s01-parse
	|	├ 🟢 baudneo/gotify-logs (+7 ~2)
	| ├ update evt.Stage : s01-parse -> s02-enrich
	| ├ create evt.Parsed.request_time_took : 757.293s
	| ├ create evt.Parsed.request_type : POST
	| ├ create evt.Parsed.source_ip : 1.2.3.4
	| ├ create evt.Parsed.timestamp : 2023-12-27T20:32:28Z
	| ├ create evt.Parsed.endpoint : /client
	| ├ update evt.StrTime : -> 2023-12-27T20:32:28Z
	| ├ create evt.Meta.log_type : gotify_failed_auth
	| ├ create evt.Meta.source_ip : 1.2.3.4
	├ s02-enrich
	|	├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
	| ├ create evt.Enriched.MarshaledTime : 2023-12-27T20:32:28Z
	| ├ update evt.Time : 2023-12-28 09:41:49.12651933 +0000 UTC -> 2023-12-27 20:32:28 +0000 UTC
	| ├ update evt.MarshaledTime : -> 2023-12-27T20:32:28Z
	| ├ create evt.Meta.timestamp : 2023-12-27T20:32:28Z
	|	├ 🟢 crowdsecurity/geoip-enrich (+10)
	| ├ create evt.Enriched.IsoCode : AU
	| ├ create evt.Enriched.Latitude : -33.494000
	| ├ create evt.Enriched.Longitude : 143.210400
	| ├ create evt.Enriched.ASNNumber : 0
	| ├ create evt.Enriched.ASNOrg : 
	| ├ create evt.Enriched.ASNumber : 0
	| ├ create evt.Enriched.IsInEU : false
	| ├ create evt.Meta.ASNNumber : 0
	| ├ create evt.Meta.IsInEU : false
	| ├ create evt.Meta.IsoCode : AU
	├-------- parser success 🟢
	├ Scenarios
		└ 🟢 baudneo/gotify-bf

```

---

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 28, 2023, 1:43pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/3 "2023-12-28T13:43:13Z")

</div>

Hello, thank you very much for your help!!

I’m new to Crowdsec and don’t really know how to get started. Can you tell me how I should proceed?

Thank you!

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [December 28, 2023, 2:02pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/4 "2023-12-28T14:02:02Z")

</div>

The PR has been merged now so if you run these it should update

```bash
cscli hub update
cscli hub upgrade
systemctl restart crowdsec

```

Then it “should” start parsing

---

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 28, 2023, 7:38pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/5 "2023-12-28T19:38:36Z")

</div>

Hi,  
wow works perfectly ! Thank you very much!

---

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 28, 2023, 11:47pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/6 "2023-12-28T23:47:35Z")

</div>

Hello,  
I still have a small problem: if I log in incorrectly locally to gotify, I will be recognized by CrowdSec and banned. If I log in via the Internet (subdomain), Crowdsec also recognizes my public IP address and also bans me, but I still have access to Gotify.  
Maybe brief information about my config.  
I have Proxmox 3 Server running:  
Gotify, Bitwarden, Nextcloud and Nginx Proxy Manager.

The servers are passed on to the domain through the proxy manager.

I have already installed the proxy manager according to the installation instructions.

> **[Protect Your Websites with CrowdSec and Nginx Proxy Manager](https://www.crowdsec.net/blog/crowdsec-with-nginx-proxy-manager)**
>
> Follow this tutorial and learn how to add an extra layer of protection to your websites with Nginx Proxy Manager and CrowdSec.

Strangely enough, CrowdSec recognized me on the Nginx Proxy Manager (LePresidente/http-generic-401-bf) and started a captcha request, but I didn’t receive one and was still able to log in.

Maybe I’m approaching it the wrong way and should only install CrowdSec on the Nginx Proxy Manager and then query the other servers via Syslog?

Many thanks for the help!

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [December 29, 2023, 9:16am UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/7 "2023-12-29T09:16:48Z")

</div>

Which remediation components are you using? are they connected and working if you run `cscli bouncers list`

---

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 29, 2023, 1:04pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/8 "2023-12-29T13:04:42Z")

</div>

Hello,  
I have Gotify running as an lxc container on Proxmox (Own IP):

 ![gotify](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/69c9f4da5ffa2499882eb044e7e59f7b865e7d36.png)

and Nginx Proxy Manager as lxc container on Proxmox (Own IP):

 ![proxy manager](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/4f4ba13e32c3e2a465956a887460ec24659e231f.png)

Here is a Log of Gotify. In Local Network it Works but not over Proxy Manager:

 ![Help](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/51ccc3bf06e404815883d0af5154d1fb213f7b16.png)

---

<div class="post-metadata">

**Author:** ![Benjamin](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Post date:** [December 30, 2023, 11:29pm UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/9 "2023-12-30T23:29:06Z")

</div>

OK,  
i think i found the Problem. I Need to Setup the local API beween Gotify an Nginx Proxy Manager. (Client to Host). Is there anybody to Help me Seting up this ?  
I found this:

> **[Introduction | CrowdSec](https://docs.crowdsec.net/docs/local_api/intro/)**
>
> The Local API (LAPI) is a core component of CrowdSec to :

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [January 2, 2024, 8:19am UTC](https://discourse.crowdsec.net/t/crowdsec-gotify-parser-not-work/1572/10 "2024-01-02T08:19:08Z")

</div>

From the images you took, it seems the `npm-proxy` bouncer is not connect or having issues connecting. I would make sure it is working and check the error logs.