{"record":{"id":"ef70ca5746ba0e08","repo":"crowdsecurity/crowdsec","slug":"event-meta-v-w-w","errorCode":null,"errorMessage":"event meta '%v': %w: %w","messagePattern":"event meta '(.+?)': %w: %w","errorType":"exception","errorClass":"MarshalFail","httpStatus":null,"severity":"error","filePath":"pkg/database/alerts.go","lineNumber":460,"sourceCode":"\tdropped := false\n\n\tif len(alertItem.Events) == 0 {\n\t\treturn nil, nil\n\t}\n\n\teventBulk := make([]*ent.EventCreate, len(alertItem.Events))\n\n\tfor i, eventItem := range alertItem.Events {\n\t\tts, err := time.Parse(time.RFC3339, *eventItem.Timestamp)\n\t\tif err != nil {\n\t\t\tlogger.Errorf(\"creating alert: Failed to parse event timestamp '%s', defaulting to now: %s\", *eventItem.Timestamp, err)\n\n\t\t\tts = time.Now().UTC()\n\t\t}\n\n\t\tmarshallMetas, err := json.Marshal(eventItem.Meta)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"event meta '%v': %w: %w\", eventItem.Meta, err, MarshalFail)\n\t\t}\n\n\t\t// the serialized field is too big, let's try to progressively strip it\n\t\tif event.SerializedValidator(string(marshallMetas)) != nil {\n\t\t\tstripped = true\n\n\t\t\tvalid := false\n\t\t\tstripSize := 2048\n\n\t\t\tfor !valid && stripSize > 0 {\n\t\t\t\tfor _, serializedItem := range eventItem.Meta {\n\t\t\t\t\tif len(serializedItem.Value) > stripSize*2 {\n\t\t\t\t\t\tserializedItem.Value = serializedItem.Value[:stripSize] + \"<stripped>\"\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tmarshallMetas, err = json.Marshal(eventItem.Meta)\n\t\t\t\tif err != nil {","sourceCodeStart":442,"sourceCodeEnd":478,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/alerts.go#L442-L478","documentation":"json.Marshal failed while serializing the Meta map of an event attached to an alert being saved to the database. Marshal of a map[string]models.Meta normally only fails for unsupported types (channels, funcs, cyclic structures), so this signals malformed/unsupported payload data in an alert pushed to LAPI. The alert save is aborted with the MarshalFail sentinel.","triggerScenarios":"Inserting an alert (createAlertBatch -> buildEventCreates) whose eventItem.Meta contains values json cannot encode: cyclic references, unsupported types, or invalid UTF-8 keys in the map when marshaled with invalid UTF-8 handling.","commonSituations":"Custom parsers emitting exotic types into event meta; a parsing pipeline bug producing self-referencing structures; third-party integrations pushing alerts with non-string-safe meta values to LAPI.","solutions":["Inspect the logged '%v' representation of the meta to identify the unencodable value and fix the producer (usually the parser or an LAPI client)","Sanitize event meta before pushing: ensure all keys/values are JSON-safe strings","Add validation in the LAPI client/producer using json.Marshal as a pre-check before sending the alert","If you control the ingestion path, log and drop the offending event instead of failing the whole alert batch"],"exampleFix":"// before\nalert.Events[0].Meta = models.Meta{Events: map[string][]string{...}} // cyclic/unencodable value\n// after\nraw, err := json.Marshal(meta)\nif err != nil {\n    log.Warningf(\"dropping unencodable event meta: %s\", err)\n    meta = models.Meta{}\n}","handlingStrategy":"validation","validationCode":"if _, err := json.Marshal(eventItem.Meta); err != nil {\n    // sanitize or drop before pushing to LAPI\n}","typeGuard":null,"tryCatchPattern":"var marshalErr *database.MarshalFail\nif errors.As(err, &marshalErr) {\n    log.Errorf(\"alert rejected: unencodable event meta: %s\", err)\n}","preventionTips":["Keep event meta restricted to map[string]string-compatible data","Pre-marshal complex data to strings in the parser before attaching meta","Test parsers end-to-end through alert creation, not just output generation","Reject or sanitize exotic meta values at the LAPI client boundary"],"tags":["crowdsec","database","json","alerts"],"backgroundTag":"json-marshal-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}