crowdsecurity/crowdsec · error

invalid input format

Error message

invalid input format

What it means

ParseKV (an expr helper) found no key/value pairs matching keyValuePattern in the input line passed to ParseKV(); the blob contained no recognized 'key: value' or similar pairs, so the target map is left unpopulated and the expression fails.

Source

Thrown at pkg/exprhelpers/helpers.go:988

	encoded := params[0].(string)

	decoded, err := base64.StdEncoding.DecodeString(encoded)
	if err != nil {
		return "", err
	}

	return string(decoded), nil
}

func ParseKV(params ...any) (any, error) {
	blob := params[0].(string)
	target := params[1].(map[string]any)
	prefix := params[2].(string)

	matches := keyValuePattern.FindAllStringSubmatch(blob, -1)
	if matches == nil {
		log.Errorf("could not find any key/value pair in line")
		return nil, errors.New("invalid input format")
	}

	if _, ok := target[prefix]; !ok {
		target[prefix] = make(map[string]string)
	} else {
		_, ok := target[prefix].(map[string]string)
		if !ok {
			log.Errorf("ParseKV: target is not a map[string]string")
			return nil, errors.New("target is not a map[string]string")
		}
	}

	for _, match := range matches {
		key := ""
		value := ""

		for i, name := range keyValuePattern.SubexpNames() {
			switch {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the log format actually contains key=value pairs
2. Apply ParseKV only after a parser stage that produces KV-formatted output
3. Adjust the upstream parser to normalize lines into key=value form

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:988 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7d44889255af72b6. Report an issue: GitHub.