Dateformat for Immich doesn't match with other formats

Aperta
  • Qualcosa non va?
#1,602 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
yaml
Ambito
tooling

Direzione di ricerca

Start with the Immich parser configuration in immich-logs.yaml and compare its IMMICH_CUSTOMDATE format with the example log's date. Run the reported cscli explain command to check parsing and timestamp handling. Done means the log parses successfully and its timestamp is interpreted correctly.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug
When I use https://app.crowdsec.net/hub/author/gauth-fr/collections/immich for my Immich server, it can't parse the logs.
Here is an example log string (from journalctl): Dez 10 13:40:02 host immich[400]: [Nest] 400 - 10.12.2025, 13:40:02 WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167.
Note the date format: 10.12.2025 instead of 12/10/2025. When I change the line IMMICH_CUSTOMDATE: "%{MONTHNUM2}/%{MONTHDAY}/%{YEAR}, %{TIME}" to IMMICH_CUSTOMDATE: "%{MONTHDAY}.%{MONTHNUM2}.%{YEAR}, %{TIME}" in immich-logs.yaml I can see this via explain:

cscli explain -l "Dez 10 13:40:02 host immich[400]: [Nest] 400  - 10.12.2025, 13:40:02    WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167" -t syslog -v
line: Dez 10 13:40:02 host immich[400]: [Nest] 400  - 10.12.2025, 13:40:02    WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167
        ├ s00-raw
        |       └ 🟢 crowdsecurity/syslog-logs (+12 ~9)
        |               └ update evt.ExpectMode : %!s(int=0) -> 1
        |               └ update evt.Stage :  -> s01-parse
        |               └ update evt.Line.Raw :  -> Dez 10 13:40:02 host immich[400]: [Nest] 400  - 10.12.2025, 13:40:02    WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167
        |               └ update evt.Line.Src :  -> /tmp/cscli_explain22703678/cscli_test_tmp.log
        |               └ update evt.Line.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-12-10 13:45:42.607593638 +0000 UTC
        |               └ create evt.Line.Labels.type : syslog
        |               └ update evt.Line.Process : %!s(bool=false) -> true
        |               └ update evt.Line.Module :  -> file
        |               └ create evt.Parsed.timestamp8601 : 
        |               └ create evt.Parsed.facility : 
        |               └ create evt.Parsed.logsource : syslog
        |               └ create evt.Parsed.message : [Nest] 400  - 10.12.2025, 13:40:02    WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167
        |               └ create evt.Parsed.pid : 400
        |               └ create evt.Parsed.priority : 
        |               └ create evt.Parsed.program : immich
        |               └ create evt.Parsed.timestamp : Dez 10 13:40:02
        |               └ update evt.Time : 0001-01-01 00:00:00 +0000 UTC -> 2025-12-10 13:45:42.607632844 +0000 UTC
        |               └ update evt.StrTime :  -> Dez 10 13:40:02
        |               └ create evt.Meta.datasource_path : /tmp/cscli_explain22703678/cscli_test_tmp.log
        |               └ create evt.Meta.datasource_type : file
        |               └ create evt.Meta.machine : host
        ├ s01-parse
        |       └ 🟢 gauth-fr/immich-logs (+6 ~4)
        |               └ update evt.Stage : s01-parse -> s02-enrich
        |               └ update evt.Parsed.timestamp : Dez 10 13:40:02 -> 10.12.2025, 13:40:02
        |               └ create evt.Parsed.source_ip : 192.168.230.167
        |               └ create evt.Parsed.username : [email protected]
        |               └ update evt.StrTime : Dez 10 13:40:02 -> 10.12.2025, 13:40:02
        |               └ update evt.StrTimeFormat :  -> 01/02/2006, 15:04:05
        |               └ create evt.Meta.log_type : immich_failed_auth
        |               └ create evt.Meta.service : immich
        |               └ create evt.Meta.source_ip : 192.168.230.167
        |               └ create evt.Meta.user : [email protected]
        ├ s02-enrich
        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
        |               ├ create evt.Enriched.MarshaledTime : 1970-01-01T01:00:10+01:00
        |               ├ update evt.Time : 2025-12-10 13:45:42.607632844 +0000 UTC -> 1970-01-01 01:00:10 +0100 CET
        |               ├ update evt.MarshaledTime :  -> 1970-01-01T01:00:10+01:00
        |               ├ create evt.Meta.timestamp : 1970-01-01T01:00:10+01:00
        |       ├ 🔴 crowdsecurity/geoip-enrich
        |       └ 🟢 crowdsecurity/public-dns-allowlist (unchanged)
        ├-------- parser success 🟢
        ├ Scenarios
                ├ 🟢 gauth-fr/immich-bf
                └ 🟢 gauth-fr/immich-bf_user-enum

Maybe there other failures too, I test it only with this single change.

To Reproduce
cscli explain -l "Dez 10 13:40:02 host immich[400]: [Nest] 400 - 10.12.2025, 13:40:02 WARN [Api:AuthService~8hfctsaf] Failed login attempt for user [email protected] from ip address 192.168.230.167" -t syslog -v

Expected behavior
No errors and a parsable log entry

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
I'm running Immich via NixOS and so the logging is via syslog:

---
source: journalctl
journalctl_filter:
  - "SYSLOG_IDENTIFER=immich-server"
labels:
  type: syslog

I don't think that bother something, only the date format is in another language. But I would expect that this shouldn't matter Crowdsec at all.
Also note: My Server doesn't use UTC but Crowdsec does think this timestamp is UTC, that is NOT CORRECT.
update evt.Time : 2025-12-10 13:45:42.607632844 +0000 UTC -> 1970-01-01 01:00:10 +0100 CET

Lingua principale
Python
Stelle
257
Fork
235
Merge medio
3g 20h
PR unite (30g)
27

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di crowdsecurity/hub

Tutte le issue di crowdsecurity/hub

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.