{"record":{"id":"e8f3e258d6237d5e","repo":"crowdsecurity/crowdsec","slug":"bad-http-response-code-d-s-w","errorCode":null,"errorMessage":"bad HTTP response code: %d: %s: %w","messagePattern":"bad HTTP response code: (.+?): (.+?): %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/loki/internal/lokiclient/loki_client.go","lineNumber":150,"sourceCode":"\t\t\treturn ctx.Err()\n\t\tcase <-lc.t.Dying():\n\t\t\treturn lc.t.Err()\n\t\tcase <-ticker.C:\n\t\t\tresp, err := lc.Get(ctx, uri)\n\t\t\tif err != nil {\n\t\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\t\treturn fmt.Errorf(\"error querying range: %w\", err)\n\t\t\t\t}\n\t\t\t\tlc.increaseTicker(ticker)\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif resp.StatusCode != http.StatusOK {\n\t\t\t\tlc.Logger.Warnf(\"bad HTTP response code for query range: %d\", resp.StatusCode)\n\t\t\t\tbody, _ := io.ReadAll(resp.Body)\n\t\t\t\tresp.Body.Close()\n\t\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\t\treturn fmt.Errorf(\"bad HTTP response code: %d: %s: %w\", resp.StatusCode, string(body), err)\n\t\t\t\t}\n\t\t\t\tlc.increaseTicker(ticker)\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tvar lq LokiQueryRangeResponse\n\t\t\tif err := json.NewDecoder(resp.Body).Decode(&lq); err != nil {\n\t\t\t\tresp.Body.Close()\n\t\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\t\treturn fmt.Errorf(\"error decoding Loki response: %w\", err)\n\t\t\t\t}\n\t\t\t\tlc.increaseTicker(ticker)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tresp.Body.Close()\n\t\t\tlc.Logger.Tracef(\"Got response: %+v\", lq)\n\t\t\tc <- &lq\n\t\t\tlc.resetFailStart()","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/loki/internal/lokiclient/loki_client.go#L132-L168","documentation":"queryRange received a non-200 HTTP response from Loki and, after retries were exhausted, wraps the status code and response body. Note the wrapping uses err, which at this point is typically nil — the useful detail is the status code and body captured in the message.","triggerScenarios":"Loki returns 4xx/5xx, e.g. 400 for an invalid query (bad LogQL selector), 429 rate limit, 503 when the distributor/ingester is unavailable.","commonSituations":"LogQL syntax errors in the datasource config; Loki rate limits hit (429); query beyond Loki's retention window returning 4xx.","solutions":["Read the status code and body in the error to identify the Loki-side cause","Validate the LogQL query string (e.g. loki-cli or the Loki UI)","If 429: lower query frequency/limit or raise Loki rate limits","If 5xx: check Loki server logs and cluster health"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: check the query returns 200\n// curl -sG -o /dev/null -w '%{http_code}' loki:3100/loki/api/v1/query_range --data-urlencode 'query={job=\"app\"}'","typeGuard":null,"tryCatchPattern":"var httpErr *HTTPStatusError\nif errors.As(err, &httpErr) && httpErr.Code == 429 {\n    // back off / slow down query rate\n} else if errors.As(err, &httpErr) {\n    log.Errorf(\"loki rejected request: %d %s\", httpErr.Code, httpErr.Body)\n}","preventionTips":["Validate LogQL syntax before deploying","Respect Loki rate limits; reduce query frequency/limit","Watch Loki 5xx health alerts"],"tags":["loki","http","api-response"],"backgroundTag":"http-error-response","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}