{"record":{"id":"6407fe43a442c1d8","repo":"crowdsecurity/crowdsec","slug":"invalid-generated-alert-w-s","errorCode":null,"errorMessage":"invalid generated alert: %w: %s","messagePattern":"invalid generated alert: %w: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":388,"sourceCode":"\n\tapiAlert.Meta, warnings = alertcontext.EventToContext(leaky.Queue.GetQueue())\n\tfor _, w := range warnings {\n\t\tlog.Warningf(\"while extracting context from bucket %s : %s\", leaky.Factory.Spec.Name, w)\n\t}\n\n\t// Loop over the Sources and generate appropriate number of ApiAlerts\n\tfor _, srcValue := range sources {\n\t\tnewApiAlert := apiAlert\n\t\tsrcCopy := srcValue\n\t\tnewApiAlert.Source = &srcCopy\n\n\t\t//revive:disable-next-line:bool-literal-in-expr\n\t\tif v, ok := leaky.Factory.Spec.Labels[\"remediation\"]; ok && v == true {\n\t\t\tnewApiAlert.Remediation = true\n\t\t}\n\n\t\tif err := newApiAlert.Validate(strfmt.Default); err != nil {\n\t\t\treturn runtimeAlert, fmt.Errorf(\"invalid generated alert: %w: %s\", err, spew.Sdump(newApiAlert))\n\t\t}\n\n\t\truntimeAlert.APIAlerts = append(runtimeAlert.APIAlerts, newApiAlert)\n\t}\n\n\tif len(runtimeAlert.APIAlerts) > 0 {\n\t\truntimeAlert.Alert = &runtimeAlert.APIAlerts[0]\n\t}\n\n\tif leaky.Factory.Spec.Reprocess {\n\t\truntimeAlert.Reprocess = true\n\t}\n\n\treturn runtimeAlert, nil\n}\n","sourceCodeStart":370,"sourceCodeEnd":404,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L370-L404","documentation":"After constructing the generated API alert(s) (models.Alert), NewAlert validates each against the go-swagger generated schema using newApiAlert.Validate(strfmt.Default). If validation fails, the alert is rejected and the full dumped alert (spew.Sdump) is included in the error. This guards against producing alerts that the Local API / database layer would reject, usually due to missing or out-of-spec fields.","triggerScenarios":"overflow → NewAlert; the constructed models.Alert fails Validate — e.g. empty required fields (machine ID, scenario, events, sources), timestamps in wrong format, or a field violating the swagger spec constraints after unusual bucket/label configuration.","commonSituations":"Scenarios with empty or malformed labels (e.g. remediation label set as a string), missing capacity/leakspeed settings producing out-of-range values, or corrupted/empty event queues yielding alerts without required references.","solutions":["Read the validation error and the spew dump to see which field failed which constraint","Check the scenario definition: name, labels, capacity, leakspeed, and that events are non-empty","Fix the offending scenario field or bucket configuration and reload the hub","If caused by a crowdsec bug (spec-conformant config still failing), report with the dumped alert"],"exampleFix":"// before (scenario labels)\nlabels:\n  remediation: \"true\"\n// after\nlabels:\n  remediation: true","handlingStrategy":"validation","validationCode":"// Validate a generated alert the same way before returning it:\nif err := alert.Validate(strfmt.Default); err != nil {\n    return fmt.Errorf(\"pre-check failed: %w\", err)\n}","typeGuard":"// Ensure required fields are non-nil before building:\nif leaky == nil || len(queue.GetQueue()) == 0 { return nil, errors.New(\"empty overflow\") }","tryCatchPattern":"alert, err := leakybucket.NewAlert(leaky, queue)\nvar valErr error\nif err != nil && errors.As(err, &valErr) && strings.Contains(err.Error(), \"invalid generated alert\") {\n    log.Errorf(\"generated alert rejected: %v\", err) // spew dump included\n}","preventionTips":["Keep scenario labels typed correctly in YAML (booleans as booleans)","Never hand-edit generated bucket definitions without revalidating","Test alert generation in a dev instance after config changes","Report crowdsec bugs with the spew dump included in the error"],"tags":["crowdsec","alert","validation","swagger"],"backgroundTag":"schema-validation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}