# Cscli explain syntax problem

**URL:** <https://discourse.crowdsec.net/t/cscli-explain-syntax-problem/806>\
**Category:** crowdsec\
**Created:** [May 25, 2022, 7:15am UTC](https://discourse.crowdsec.net/t/cscli-explain-syntax-problem/806 "2022-05-25T07:15:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ianpmurphy](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/ianpmurphy/32/354_2.png) [@ianpmurphy](https://discourse.crowdsec.net/u/ianpmurphy)\
**Post date:** [May 25, 2022, 7:15am UTC](https://discourse.crowdsec.net/t/cscli-explain-syntax-problem/806/1 "2022-05-25T07:15:50Z")

</div>

I’ve just been experimenting and tried using explain on the last line in my haproxy.log

`# cscli explain --verbose --log 'May 25 06:57:27 nginxsrv haproxy[1055]: 12.9.1.27:49871 [25/May/2022:06:57:27.272] fe_https_in~ be/httpserver 0/0/2/20/22 200 297 - - --NI 1/1/0/0/0 0/0 {www.domain.com} "POST /site/page.aspx?12345&9 HTTP/1.0' --type haproxy`

and it responded with

```auto
line: May 25 06:57:27 nginxsrv haproxy[1055]: 12.9.1.27:49871 [25/May/2022:06:57:27.272] fe_https_in~ be/httpserver 0/0/2/20/22 200 297 - - --NI 1/1/0/0/0 0/0 {www.domain.com} "POST /path/page.aspx?12345&9 HTTP/1.0
        â s00-raw
        | â ð¢ crowdsecurity/non-syslog (first_parser)
        | â ð´ crowdsecurity/syslog-logs
        â s01-parse
        | â ð´ crowdsecurity/haproxy-logs
        | â ð´ crowdsecurity/sshd-logs
        â-------- parser failure ð´

```

I read this as saying that crowdsec has failed to parse haproxy log.

Have I failed to specify the log format correctly? Is my syntax incorrect?

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [May 25, 2022, 1:15pm UTC](https://discourse.crowdsec.net/t/cscli-explain-syntax-problem/806/2 "2022-05-25T13:15:07Z")

</div>

Hello,

Sorry your output doesn’t render very well and eats the colors so I’m not sure I can read what works or not.

However, it seems that you log line is incomplete, there is an unbalanced double quote :

```auto
"POST /site/page.aspx?12345&9 HTTP/1.0'

```

Don’t hesitate to look at the parser associated tests in case of doubt : [hub/haproxy-logs.log at master · crowdsecurity/hub · GitHub](https://github.com/crowdsecurity/hub/blob/master/.tests/haproxy-logs/haproxy-logs.log)

---

<div class="post-metadata">

**Author:** ![ianpmurphy](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/ianpmurphy/32/354_2.png) [@ianpmurphy](https://discourse.crowdsec.net/u/ianpmurphy)\
**Post date:** [May 30, 2022, 11:16am UTC](https://discourse.crowdsec.net/t/cscli-explain-syntax-problem/806/3 "2022-05-30T11:16:58Z")

</div>

Quite right. I should have spotted that. It works now, though I still don’t yet understand what the explanation means.