crowdsecurity/crowdsec · error

invalid Loki entry: expected [timestamp, line], got %v

Error message

invalid Loki entry: expected [timestamp, line], got %v

What it means

The Loki client's custom UnmarshalJSON for stream entries expects each entry to be a two-element array [timestamp_ns, line], per Loki's query/push API. It throws when the decoded array has fewer than two elements, i.e. the server returned a malformed or non-standard entry shape.

Source

Thrown at pkg/acquisition/modules/loki/internal/lokiclient/types.go:23

	"fmt"
	"strconv"
	"time"
)

type Entry struct {
	Timestamp time.Time
	Line      string
}

func (e *Entry) UnmarshalJSON(b []byte) error {
	var values []string
	err := json.Unmarshal(b, &values)
	if err != nil {
		return err
	}

	if len(values) < 2 {
		return fmt.Errorf("invalid Loki entry: expected [timestamp, line], got %v", values)
	}

	t, err := strconv.ParseInt(values[0], 10, 64)
	if err != nil {
		return err
	}
	e.Timestamp = time.Unix(0, t)
	e.Line = values[1]
	return nil
}

type Stream struct {
	Stream  map[string]string `json:"stream"`
	Entries []Entry           `json:"values"`
}

type DroppedEntry struct {
	Labels    map[string]string `json:"labels"`

View on GitHub (pinned to 909b515798)

Solutions

1. curl the Loki query endpoint and inspect the raw entries; confirm each is ["<ns timestamp>", "<line>"]
2. Check for proxies/middlewares modifying the Loki JSON response and bypass or fix them
3. Align the server with a genuine Loki version that implements the standard entry format
4. If the backend is known-nonconformant, fix the entry format server-side or use a different acquisition module

Example fix

// before (malformed entry returned by server)
{"values": [["1638574088"]]}
// after (valid Loki entry)
{"values": [["1638574088000000000", "log line content"]]}

func validLokiEntry(raw json.RawMessage) bool {
    var vals []string
    if err := json.Unmarshal(raw, &vals); err != nil {
        return false
    }
    return len(vals) >= 2
}

func isLokiEntry(v []json.RawMessage) bool { return len(v) >= 2 }

When it happens

Trigger: Reading from Loki's query/query_range/tail endpoints when an entry's `values` array contains 0 or 1 elements — e.g. a Loki-compatible server that is not real Grafana Loki, a proxy rewriting responses, or a mocked Loki returning the wrong JSON shape.

Common situations: Pointing the datasource at third-party 'Loki-compatible' backends emitting single-element entries; intermediaries truncating or rewriting the JSON; CI mocks returning simplified payloads.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• loki query is mandatory
• invalid Loki entry: expected [timestamp, line], got %v
• error decoding Loki response: %w
• loki is not ready: %w
• appsec datasource requires a hub. this is a bug, please repo

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4d4b5110173ef3fb. Report an issue: GitHub.