{"record":{"id":"4d4b5110173ef3fb","repo":"crowdsecurity/crowdsec","slug":"invalid-loki-entry-expected-timestamp-line-go-4d4b51","errorCode":null,"errorMessage":"invalid Loki entry: expected [timestamp, line], got %v","messagePattern":"invalid Loki entry: expected \\[timestamp, line\\], got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/loki/internal/lokiclient/types.go","lineNumber":23,"sourceCode":"\t\"fmt\"\n\t\"strconv\"\n\t\"time\"\n)\n\ntype Entry struct {\n\tTimestamp time.Time\n\tLine      string\n}\n\nfunc (e *Entry) UnmarshalJSON(b []byte) error {\n\tvar values []string\n\terr := json.Unmarshal(b, &values)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif len(values) < 2 {\n\t\treturn fmt.Errorf(\"invalid Loki entry: expected [timestamp, line], got %v\", values)\n\t}\n\n\tt, err := strconv.ParseInt(values[0], 10, 64)\n\tif err != nil {\n\t\treturn err\n\t}\n\te.Timestamp = time.Unix(0, t)\n\te.Line = values[1]\n\treturn nil\n}\n\ntype Stream struct {\n\tStream  map[string]string `json:\"stream\"`\n\tEntries []Entry           `json:\"values\"`\n}\n\ntype DroppedEntry struct {\n\tLabels    map[string]string `json:\"labels\"`","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/loki/internal/lokiclient/types.go#L5-L41","documentation":"The Loki client's custom UnmarshalJSON for stream entries expects each entry to be a two-element array [timestamp_ns, line], per Loki's query/push API. It throws when the decoded array has fewer than two elements, i.e. the server returned a malformed or non-standard entry shape.","triggerScenarios":"Reading from Loki's query/query_range/tail endpoints when an entry's `values` array contains 0 or 1 elements — e.g. a Loki-compatible server that is not real Grafana Loki, a proxy rewriting responses, or a mocked Loki returning the wrong JSON shape.","commonSituations":"Pointing the datasource at third-party 'Loki-compatible' backends emitting single-element entries; intermediaries truncating or rewriting the JSON; CI mocks returning simplified payloads.","solutions":["curl the Loki query endpoint and inspect the raw entries; confirm each is [\"<ns timestamp>\", \"<line>\"]","Check for proxies/middlewares modifying the Loki JSON response and bypass or fix them","Align the server with a genuine Loki version that implements the standard entry format","If the backend is known-nonconformant, fix the entry format server-side or use a different acquisition module"],"exampleFix":"// before (malformed entry returned by server)\n{\"values\": [[\"1638574088\"]]}\n// after (valid Loki entry)\n{\"values\": [[\"1638574088000000000\", \"log line content\"]]}","handlingStrategy":"type-guard","validationCode":"func validLokiEntry(raw json.RawMessage) bool {\n    var vals []string\n    if err := json.Unmarshal(raw, &vals); err != nil {\n        return false\n    }\n    return len(vals) >= 2\n}","typeGuard":"func isLokiEntry(v []json.RawMessage) bool { return len(v) >= 2 }","tryCatchPattern":null,"preventionTips":["Point the datasource only at servers returning the standard [timestamp_ns, line] entry arrays","Inspect a raw query response with curl before wiring it into crowdsec","Pin and test against a fixed Loki version in CI","Avoid proxies that rewrite Loki JSON responses"],"tags":["loki","json","acquisition"],"backgroundTag":"schema-validation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}