crowdsecurity/crowdsec · error · QueryFail

get all decisions with filters: %w

Error message

get all decisions with filters: %w

What it means

This error is returned by Client.QueryAllDecisionsWithFilters when the decision filter expression cannot be translated/applied to the ent query. It wraps the shared sentinel QueryFail ("unable to query"), so the underlying cause is only available in the CrowdSec log line ('QueryAllDecisionsWithFilters : <err>') emitted just before the error is returned.

Source

Thrown at pkg/database/decisions.go:43

}

func (c *Client) QueryAllDecisionsWithFilters(ctx context.Context, now time.Time, filter map[string][]string) ([]*ent.Decision, error) {
	// Do not select all fields.
	// This can get pretty expensive network-wise if there are a lot of decisions and you are using a remote database
	query := c.Ent.Decision.Query().
		Select(decision.FieldID, decision.FieldUntil, decision.FieldScenario, decision.FieldScope, decision.FieldValue, decision.FieldType, decision.FieldOrigin, decision.FieldUUID).
		Where(
			decision.UntilGT(now),
		)
	// Allow a bouncer to ask for non-deduplicated results
	if v, ok := filter["dedup"]; !ok || v[0] != "false" {
		query = query.Where(longestDecisionForScopeTypeValue)
	}

	query, err := applyDecisionFilter(query, filter)
	if err != nil {
		c.Log.Warningf("QueryAllDecisionsWithFilters : %s", err)
		return []*ent.Decision{}, fmt.Errorf("get all decisions with filters: %w", QueryFail)
	}

	query = query.Order(ent.Asc(decision.FieldID))

	data, err := query.All(ctx)
	if err != nil {
		c.Log.Warningf("QueryAllDecisionsWithFilters : %s", err)
		return []*ent.Decision{}, fmt.Errorf("get all decisions with filters: %w", QueryFail)
	}

	return data, nil
}

func (c *Client) LatestDecisionID(ctx context.Context) (int, error) {
	latest, err := c.Ent.Decision.Query().
		Select(decision.FieldID).
		Order(ent.Desc(decision.FieldID)).
		First(ctx)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the crowdsec/LAPI log for the 'QueryAllDecisionsWithFilters :' warning to see the real underlying parse error
2. Validate filter keys and value formats (scope, type, value, ip) before sending the request
3. Remove unknown/unsupported query parameters from the /decisions call
4. Test the filter locally with `cscli decisions list --contains ...` to reproduce the parse failure

Example fix

// before
decisions, err := client.Decisions.List(ctx, map[string][]string{"scopes": {"ip"}})
// after (use valid filter keys/values)
decisions, err := client.Decisions.List(ctx, map[string][]string{"scope": {"ip"}, "value": {"1.2.3.4"}})

validKeys := map[string]bool{"scope":true,"value":true,"type":true,"origin":true,"scenario":true,"ip":true,"since":true,"hasBeenRemediated":true,"hasActiveDecision":true}
for k, vs := range filter {
    if !validKeys[k] { return fmt.Errorf("unsupported decision filter key %q", k) }
    for _, v := range vs { if v == "" { return fmt.Errorf("empty value for filter %q", k) } }
}

decisions, err := client.QueryAllDecisionsWithFilters(ctx, filter)
if err != nil {
    if strings.Contains(err.Error(), "unable to query") {
        // malformed filter; check LAPI logs for 'QueryAllDecisionsWithFilters :'
        return fmt.Errorf("bad decision filter: %w", err)
    }
    return err
}

When it happens

Trigger: applyDecisionFilter fails while parsing a filter map key/value into an ent predicate — e.g. a caller (LAPI /decisions request) passes an unsupported filter key, a malformed value (bad scope, non-boolean 'has been remediated', invalid IP in 'ip' range), or the contains-ip helper cannot parse the value.

Common situations: A bouncer or cscli calls the LAPI with ?scope=...&value=...&type=... where one value doesn't match expected formats (e.g. scope 'ip' with a non-IP/CIDR value, or an unknown filter parameter added by a newer client against an older LAPI).

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• get expired decisions with filters: %w
• expired decisions with filters: %w
• machine not found
• latest decision id: %w
• query decision failed: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8b1f270528265fc1. Report an issue: GitHub.