{"record":{"id":"d9865c327ae18df1","repo":"crowdsecurity/crowdsec","slug":"expired-decisions-with-filters-w","errorCode":null,"errorMessage":"expired decisions with filters: %w","messagePattern":"expired decisions with filters: %w","errorType":"exception","errorClass":"QueryFail","httpStatus":null,"severity":"error","filePath":"pkg/database/decisions.go","lineNumber":205,"sourceCode":"\tquery := c.Ent.Decision.Query().\n\t\tSelect(decision.FieldID, decision.FieldUntil, decision.FieldScenario, decision.FieldScope, decision.FieldValue, decision.FieldType, decision.FieldOrigin, decision.FieldUUID).\n\t\tWhere(\n\t\t\tdecision.UntilLT(now),\n\t\t)\n\n\tif since != nil {\n\t\tquery = query.Where(decision.UntilGT(*since))\n\t}\n\n\t// Allow a bouncer to ask for non-deduplicated results\n\tif v, ok := filter[\"dedup\"]; !ok || v[0] != \"false\" {\n\t\tquery = query.Where(longestDecisionForScopeTypeValue)\n\t}\n\n\tquery, err := applyDecisionFilter(query, filter)\n\tif err != nil {\n\t\tc.Log.Warningf(\"QueryExpiredDecisionsSinceWithFilters : %s\", err)\n\t\treturn []*ent.Decision{}, fmt.Errorf(\"expired decisions with filters: %w\", QueryFail)\n\t}\n\n\tquery = query.Order(ent.Asc(decision.FieldID))\n\n\tdata, err := query.All(ctx)\n\tif err != nil {\n\t\tc.Log.Warningf(\"QueryExpiredDecisionsSinceWithFilters : %s\", err)\n\t\treturn []*ent.Decision{}, fmt.Errorf(\"expired decisions with filters: %w\", QueryFail)\n\t}\n\n\treturn data, nil\n}\n\n// ExpireDecisionsWithFilter updates the expiration time to now() for the decisions matching the filter, and returns the updated items\nfunc (c *Client) ExpireDecisionsWithFilter(ctx context.Context, filter map[string][]string) (int, []*ent.Decision, error) {\n\tvar (\n\t\terr error\n\t\trng csnet.Range","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/decisions.go#L187-L223","documentation":"Returned by QueryExpiredDecisionsSinceWithFilters when applyDecisionFilter cannot translate the filter map into ent predicates. Wraps QueryFail (\"unable to query\"); the parse error is logged as 'QueryExpiredDecisionsSinceWithFilters : <err>'.","triggerScenarios":"Caller (e.g. stream/ expired-decision pull with a 'since' parameter) passes an invalid filter value — unparsable duration for since, malformed scope/type/value, or bad IP in an ip filter.","commonSituations":"Custom bouncers or scripts calling LAPI /decisions/stream with an unencoded or malformed query string; version drift where a newer client sends filter keys the server's applyDecisionFilter rejects.","solutions":["Find the actual parse failure in the 'QueryExpiredDecisionsSinceWithFilters :' log line","Correct the filter keys/values (check 'since' duration format and scope/value formats)","URL-encode query parameters when calling the LAPI HTTP endpoint directly","Align bouncer and LAPI versions if the filter vocabulary differs"],"exampleFix":"// before\nGET /v1/decisions/stream?since=last-hour\n// after\nGET /v1/decisions/stream?since=1h","handlingStrategy":"validation","validationCode":"const sinceRe = `^([0-9]+(ns|us|ms|s|m|h))+$`\nif !regexp.MustCompile(sinceRe).MatchString(since) {\n    return fmt.Errorf(\"invalid since %q; use Go duration format like 1h30m\", since)\n}","typeGuard":null,"tryCatchPattern":"res, err := client.QueryExpiredDecisionsSinceWithFilters(ctx, since, filter)\nif err != nil && strings.Contains(err.Error(), \"unable to query\") {\n    return fmt.Errorf(\"filter rejected: %w (see LAPI log 'QueryExpiredDecisionsSinceWithFilters')\", err)\n}","preventionTips":["Always use Go duration strings for 'since' filters","Encode query parameters when hitting the HTTP API directly","Test filters with cscli before embedding them in scripts"],"tags":["database","crowdsec","filter-parsing","lapi"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}