{"record":{"id":"2a25a0325dcfd93c","repo":"crowdsecurity/crowdsec","slug":"jsonextracttype-s-w","errorCode":null,"errorMessage":"jsonExtractType: %s : %w","messagePattern":"jsonExtractType: (.+?) : %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exprhelpers/jsonextract.go","lineNumber":101,"sourceCode":"func jsonExtractType(jsblob string, target string, t jsonparser.ValueType) ([]byte, error) {\n\tif !strings.HasPrefix(target, \"[\") {\n\t\ttarget = strings.ReplaceAll(target, \"[\", \".[\")\n\t}\n\tfullpath := strings.Split(target, \".\")\n\n\tlog.Tracef(\"extract path %+v\", fullpath)\n\n\tvalue, dataType, _, err := jsonparser.Get(\n\t\tjsonparser.StringToBytes(jsblob),\n\t\tfullpath...,\n\t)\n\tif err != nil {\n\t\tif errors.Is(err, jsonparser.KeyPathNotFoundError) {\n\t\t\tlog.Debugf(\"Key %+v doesn't exist\", target)\n\t\t\treturn nil, fmt.Errorf(\"key %s does not exist\", target)\n\t\t}\n\t\tlog.Errorf(\"jsonExtractType : %s : %s\", target, err)\n\t\treturn nil, fmt.Errorf(\"jsonExtractType: %s : %w\", target, err)\n\t}\n\n\tif dataType != t {\n\t\tlog.Errorf(\"jsonExtractType : expected type %s for target %s but found %s\", t, target, dataType.String())\n\t\treturn nil, fmt.Errorf(\"jsonExtractType: expected type %s for target %s but found %s\", t, target, dataType.String())\n\t}\n\n\treturn value, nil\n}\n\n// func JsonExtractSlice(jsblob string, target string) []interface{} {\nfunc JsonExtractSlice(params ...any) (any, error) {\n\tjsblob := params[0].(string)\n\ttarget := params[1].(string)\n\n\tvalue, err := jsonExtractType(jsblob, target, jsonparser.Array)\n\tif err != nil {\n\t\tlog.Errorf(\"JsonExtractSlice : %s\", err)","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/exprhelpers/jsonextract.go#L83-L119","documentation":"When jsonparser fails for a reason other than KeyPathNotFoundError while extracting the dotted path (e.g. malformed JSON, unexpected token), jsonExtractType wraps the underlying error with the target path and returns it. It signals the blob itself could not be parsed at that path, not merely a missing key.","triggerScenarios":"Calling JsonExtractSlice/JsonExtractObject on jsblob that is not valid JSON, truncated output, empty string, or an earlier path segment resolving to a scalar so the rest of the path cannot be traversed.","commonSituations":"Feeding raw (non-JSON) log lines into the extractor; parsing partial responses cut off by network errors; concatenating JSON fragments.","solutions":["Validate the blob parses as JSON (json.Valid) before extraction","Log/inspect the raw input when this error appears — it indicates corrupt or non-JSON data","Handle the wrapped error upstream and fall back to an empty result","Fix the data source so only well-formed JSON reaches the expression"],"exampleFix":"// before\nval, _ := JsonExtractObject(rawLine, \"payload\")\n// after\nif !json.Valid([]byte(rawLine)) {\n    return nil, fmt.Errorf(\"not valid JSON\")\n}\nval, err := JsonExtractObject(rawLine, \"payload\")","handlingStrategy":"validation","validationCode":"if !json.Valid([]byte(jsblob)) {\n    return errors.New(\"input is not valid JSON\")\n}","typeGuard":null,"tryCatchPattern":"val, err := exprhelpers.JsonExtractObject(jsblob, target)\nif err != nil && strings.HasPrefix(err.Error(), \"jsonExtractType:\") {\n    log.Errorf(\"bad blob for %s: %v\", target, err)\n    return map[string]any{}, nil\n}","preventionTips":["Validate JSON before extraction when the source is untrusted or streaming","Ensure upstream producers emit complete, untruncated JSON","Guard against path segments crossing scalar boundaries","Add a canary test that extracts a known path from a known-good payload"],"tags":["go","json","parse-error"],"backgroundTag":"json-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}