cloudflare/cloudflared · error

unable to unmarshal LogEventType string

Error message

unable to unmarshal LogEventType string

What it means

Thrown by LogEventType.UnmarshalJSON in the management-tunnel protocol when the incoming JSON value for an event-type field is not a JSON string at all (e.g. a number, bool, or array), so json.Unmarshal into a string fails before ParseLogEventType can run. Indicates a malformed or hostile message from the websocket peer.

Source

Thrown at management/events.go:121

	case HTTP:
		return "http"
	case TCP:
		return "tcp"
	case UDP:
		return "udp"
	default:
		return ""
	}
}

func (l LogEventType) MarshalJSON() ([]byte, error) {
	return json.Marshal(l.String())
}

func (e *LogEventType) UnmarshalJSON(data []byte) error {
	var s string
	if err := json.Unmarshal(data, &s); err != nil {
		return errors.New("unable to unmarshal LogEventType string")
	}
	if event, ok := ParseLogEventType(s); ok {
		*e = event
		return nil
	}
	return errors.New("unable to unmarshal LogEventType")
}

// LogLevel corresponds to the zerolog logging levels
// "panic", "fatal", and "trace" are exempt from this list as they are rarely used and, at least
// the first two are limited to failure conditions that lead to cloudflared shutting down.
type LogLevel int8

const (
	Debug LogLevel = 0
	Info  LogLevel = 1
	Warn  LogLevel = 2
	Error LogLevel = 3

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Send the event type as a JSON string, e.g. {"event_type": "cloudflared.metric"}
2. Check the event type against the supported ParseLogEventType values
3. Inspect the raw JSON payload for a numeric or nested value in the event field

Example fix

// before
{"event_type": 3}
// after
{"event_type": "cloudflared.metric"}

if v, ok := raw.(string); ok { _, known := management.ParseLogEventType(v); _ = known }

func isStringPayload(b []byte) bool { return len(b) > 0 && b[0] == '"' }

var e management.LogEventType
if err := json.Unmarshal(data, &e); err != nil { log.Warn().Err(err).Str("payload", string(data)).Msg("bad event type payload") }

When it happens

Trigger: json.Unmarshal inside LogEventType.UnmarshalJSON fails because the JSON payload contains a non-string value where a LogEventType string (e.g. "cloudflared.metric") was expected.

Common situations: A management-tier client or test sends a malformed or wrongly-typed event field over the management websocket/HTTP stream.

Understand the failure class

Background: "failed to unmarshal" / json.Unmarshal errors: why parsing a response into a Go struct fails and how to fix it — this error's family across 23 libraries.

Related errors

• unable to unmarshal LogEventType
• unable to unmarshal LogLevel string
• ErrNoTunnelID
• datagram provided is an invalid size
• datagram response is an invalid size

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/4cff3a1132531552. Report an issue: GitHub.