{"record":{"id":"2c393f7ac2b62eb5","repo":"crowdsecurity/crowdsec","slug":"invalid-loki-entry-expected-timestamp-line-go","errorCode":null,"errorMessage":"invalid Loki entry: expected [timestamp, line], got %v","messagePattern":"invalid Loki entry: expected \\[timestamp, line\\], got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/loki/entry.go","lineNumber":23,"sourceCode":"\t\"fmt\"\n\t\"strconv\"\n\t\"time\"\n)\n\ntype Entry struct {\n\tTimestamp time.Time\n\tLine      string\n}\n\nfunc (e *Entry) UnmarshalJSON(b []byte) error {\n\tvar values []string\n\n\tif err := json.Unmarshal(b, &values); err != nil {\n\t\treturn err\n\t}\n\n\tif len(values) < 2 {\n\t\treturn fmt.Errorf(\"invalid Loki entry: expected [timestamp, line], got %v\", values)\n\t}\n\n\tt, err := strconv.ParseInt(values[0], 10, 64)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\te.Timestamp = time.Unix(t, 0)\n\te.Line = values[1]\n\n\treturn nil\n}\n\ntype Stream struct {\n\tStream  map[string]string `json:\"stream\"`\n\tEntries []Entry           `json:\"values\"`\n}\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/loki/entry.go#L5-L41","documentation":"Entry.UnmarshalJSON expects each Loki value entry to be a JSON array of at least two strings [timestamp_ns, line]; a shorter array (or wrong shape) in the Loki query response cannot be converted into an Entry.","triggerScenarios":"The Loki query_range or tail API returns a result entry like [\"1700000000000000000\"] or [] — typically a truncated, hand-crafted, or mocked response body.","commonSituations":"Pointing the datasource at a non-Loki HTTP endpoint that returns unexpected JSON shapes; test fixtures or proxies rewriting Loki responses.","solutions":["Verify the Loki server version and API endpoint compatibility","Check the query returns standard log entries","Inspect the raw Loki response for unexpected payloads"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func looksLikeLokiEntry(raw json.RawMessage) bool {\n    var arr []json.RawMessage\n    return json.Unmarshal(raw, &arr) == nil && len(arr) >= 2\n}","tryCatchPattern":"if err := json.Unmarshal(body, &resp); err != nil {\n    // also try decoding as LokiQueryRangeResponse to log shape\n    log.Errorf(\"unexpected Loki entry shape: %v\", err)\n    return err\n}","preventionTips":["Point at a genuine Loki /loki/api/v1 endpoint","Validate with curl that entries look like [ts,line] pairs before configuring"],"tags":["loki","json","api-response"],"backgroundTag":"unexpected-response-shape","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}