handles Traefik multilayer routing

[ook]

Description

Handles Traefik multilayer routing. Fix #1628

Checklist

• I have read the contributing guide
• I have tested my changes locally
• For new parsers or scenarios, tests have been added
• I have run the hub linter and no issues were reported (see contributing guide)
• Automated tests are passing
• AI was used to generate any/all content of this PR

[LaurenceJJones]

Personally I wouldnt alter the traefik router as that is the format of the router itself (it used in the position but we can get and set proper meta data of parent and child for alert purposes) and would move this to the CLF itself.

Mind if I take over and update it?

however, thinking back now it might break some peoples whitelists that match a full string so we probably need to keep the same naming.

[ook]

Mind if I take over and update it?

Please, do! I only wanted to help other traefik multilayer routers enthusiasts to continue using Crowdsec :)

[LaurenceJJones]

Mind if I take over and update it?

Please, do! I only wanted to help other traefik multilayer routers enthusiasts to continue using Crowdsec :)

question do you know if the json logs adds this as a new property or the RouterName key embeds both?

also test is parent and leaf is child?

[ook]

test is root and leaf is child/leaf. Please note that it can exists intermediates layers, so potentially N layers.
I don’t know for json logs, but I’ll build a test setup to check that for you.

[ook]

@LaurenceJJones here your answer https://github.com/cults/crowdsec-traefik-multilayer-logs you can play with this.
The json output:

traefik-1  | {"ClientAddr":"192.168.65.1:29366","ClientHost":"192.168.65.1","ClientPort":"29366","ClientUsername":"-","DownstreamContentSize":364,"DownstreamStatus":200,"Duration":2001375,"OriginContentSize":364,"OriginDuration":1935291,"OriginStatus":200,"Overhead":66084,"RequestAddr":"whoami.localhost","RequestContentSize":0,"RequestCount":1,"RequestHost":"whoami.localhost","RequestMethod":"GET","RequestPath":"/","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"RouterName":"root@file -\u003e intermediate1@file -\u003e intermediate2@file -\u003e leaf@file","ServiceAddr":"whoami:80","ServiceName":"whoami@file","ServiceURL":"http://whoami:80","StartLocal":"2026-01-08T14:19:15.980170592Z","StartUTC":"2026-01-08T14:19:15.980170592Z","entryPointName":"web","level":"info","msg":"","time":"2026-01-08T14:19:15Z"}

And more visually:

[LaurenceJJones]

Okay think I got it in a space, where I am happy 😅

this allow us to parse additional properties that might be useful for alert context debugging / false positive. You can see the generated asserts for the meta information basically

root: entry
intermediate: any router between root and leaf
leaf: last

[ook]

Congrats! Even I foresee the different root / leaf values for routers will be YAGNI (after all, crowdsec bouncer is always a middleware, so already inside the router chain: we already know in which kind of router we’re in), I like your implementation. Thank you!