crowdsecurity/crowdsec · warning

invalid filter

Error message

invalid filter

What it means

InvalidFilter is a sentinel error meaning a database filter expression is structurally invalid: an unknown key/value combination, an unparseable boolean for 'contains', an unknown IP size class, or any other rejection inside alert/decision predicate building. Unlike ParseType (wrong value type) it usually means the filter itself is malformed or unsupported.

Source

Thrown at pkg/database/errors.go:20

import "errors"

var (
	UserExists        = errors.New("user already exist")
	UserNotExists     = errors.New("user doesn't exist")
	HashError         = errors.New("unable to hash")
	InsertFail        = errors.New("unable to insert row")
	QueryFail         = errors.New("unable to query")
	UpdateFail        = errors.New("unable to update")
	DeleteFail        = errors.New("unable to delete")
	ItemNotFound      = errors.New("object not found")
	ParseTimeFail     = errors.New("unable to parse time")
	ParseDurationFail = errors.New("unable to parse duration")
	MarshalFail       = errors.New("unable to serialize")
	BulkError         = errors.New("unable to insert bulk")
	ParseType         = errors.New("unable to parse type")
	InvalidIPOrRange  = errors.New("invalid ip address / range")
	InvalidFilter     = errors.New("invalid filter")
)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped inner error message for the exact rejected part of the filter.
2. Verify filter keys against the current LAPI docs (keys: scope, value, ip, contains, since, until, has_active_decision, ...).
3. Use strconv.ParseBool-compatible values for contains (true/false).
4. Update the client library/cscli version to match the server if filter semantics changed.

Example fix

// before
filter := map[string][]string{"contains": {"yes"}}
alerts, err := client.ListAlerts(ctx, filter) // InvalidFilter
// after
filter := map[string][]string{"contains": {"true"}}
alerts, err := client.ListAlerts(ctx, filter)

// Go: whitelist filter keys and validate value formats before calling
var allowedKeys = map[string]bool{"scope": true, "value": true, "ip": true, "contains": true, "since": true, "until": true, "has_active_decision": true}
func validFilter(f map[string][]string) error {
    for k, vs := range f {
        if !allowedKeys[k] { return fmt.Errorf("unknown filter key %q", k) }
        for _, v := range vs {
            if k == "contains" { if _, err := strconv.ParseBool(v); err != nil { return err } }
        }
    }
    return nil
}

if err := validFilter(filter); err != nil { return err }
alerts, err := client.ListAlerts(ctx, filter)
if errors.Is(err, database.InvalidFilter) {
    return fmt.Errorf("rejected filter: %w", err)
}

When it happens

Trigger: alertPredicatesFromFilter with contains=<not-a-bool>; handleAlertIPPredicates hitting 'unknown ip size'; applyDecisionFilter/decisionIPFilter/ExpireDecisionsWithFilter with unsupported filter keys or malformed value shapes.

Common situations: Scripts building LAPI query strings with typo'd keys ("contain" instead of "contains") or wrong value formats, old clients using removed filter names after an upgrade, multi-value filters assembled incorrectly.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• unable to parse type
• invalid ip address / range
• invalid contains value: %w: %w
• path must start with /
• no database configuration provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/accb52207757cc55. Report an issue: GitHub.