{"record":{"id":"52ac95b1411641f3","repo":"crowdsecurity/crowdsec","slug":"unable-to-parse-s-as-unix-timestamp","errorCode":null,"errorMessage":"unable to parse %s as unix timestamp","messagePattern":"unable to parse (.+?) as unix timestamp","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exprhelpers/helpers.go","lineNumber":867,"sourceCode":"func LookupHost(params ...any) (any, error) {\n\tvalue := params[0].(string)\n\n\taddresses, err := net.LookupHost(value)\n\tif err != nil {\n\t\tlog.Errorf(\"Failed to lookup host '%s' : %s\", value, err)\n\t\treturn []string{}, nil\n\t}\n\n\treturn addresses, nil\n}\n\n// func ParseUnixTime(value string) (time.Time, error) {\nfunc ParseUnixTime(params ...any) (any, error) {\n\tvalue := params[0].(string)\n\t// Splitting string here as some unix timestamp may have milliseconds and break ParseInt\n\ti, err := strconv.ParseInt(strings.Split(value, \".\")[0], 10, 64)\n\tif err != nil || i <= 0 {\n\t\treturn time.Time{}, fmt.Errorf(\"unable to parse %s as unix timestamp\", value)\n\t}\n\n\treturn time.Unix(i, 0), nil\n}\n\n// func ParseUnix(value string) string {\nfunc ParseUnix(params ...any) (any, error) {\n\tvalue := params[0].(string)\n\n\tt, err := ParseUnixTime(value)\n\tif err != nil {\n\t\tlog.Error(err)\n\t\treturn \"\", nil\n\t}\n\n\treturn t.(time.Time).Format(time.RFC3339), nil\n}\n","sourceCodeStart":849,"sourceCodeEnd":885,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/exprhelpers/helpers.go#L849-L885","documentation":"ParseUnixTime parses a string containing a Unix timestamp (seconds, optional fractional part stripped) into time.Time. It returns this error when the string cannot be parsed as a base-10 integer or when the value is <= 0, both of which cannot represent a valid Unix timestamp.","triggerScenarios":"ParseUnixTime('abc'), ParseUnixTime('') , ParseUnixTime('0') or a negative value, or a value with non-numeric characters before the first '.' passed from an event field in an expression.","commonSituations":"Log field contains a formatted date instead of a Unix epoch; empty field because the regex capture missed; timestamps in milliseconds as a full integer (works, but >0) vs plain '0' placeholders; human-readable dates fed in by mistake.","solutions":["Verify the field actually contains a numeric Unix timestamp string (e.g. '1700000000')","Pre-parse with a parser node or ParseInt before calling ParseUnixTime, or use ParseDate for formatted dates","Handle millisecond timestamps by keeping them as strings — ParseUnixTime splits on '.' only for fractional seconds","Guard against empty/zero values with a condition in the expression"],"exampleFix":"// before\nParseUnixTime(evt.Time) // 'Time' is a formatted date\n// after\nParseUnixTime(evt.Timestamp) // '1700000000.123'","handlingStrategy":"validation","validationCode":"// expr: numeric string check\n// evt.ts != nil && evt.ts != \"\"","typeGuard":"func isUnixTimestampString(s string) bool {\n\tif s == \"\" { return false }\n\t_, err := strconv.ParseInt(strings.Split(s, \".\")[0], 10, 64)\n\treturn err == nil\n}","tryCatchPattern":"// wrap expression evaluation errors:\nif _, err := expr.Eval(code, env); err != nil {\n\tlog.Warnf(\"ParseUnixTime failed: %v\", err)\n}","preventionTips":["Verify the source field is a numeric epoch string, not a formatted date","Use ParseDate for human-readable timestamps","Treat 0/negative values as missing data before evaluating"],"tags":["expr","timestamp","parsing"],"backgroundTag":"invalid-date-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}