crowdsecurity/crowdsec · error

invalid Loki entry: expected [timestamp, line], got %v

Error message

invalid Loki entry: expected [timestamp, line], got %v

What it means

Entry.UnmarshalJSON expects each Loki value entry to be a JSON array of at least two strings [timestamp_ns, line]; a shorter array (or wrong shape) in the Loki query response cannot be converted into an Entry.

Source

Thrown at pkg/acquisition/modules/loki/entry.go:23

	"fmt"
	"strconv"
	"time"
)

type Entry struct {
	Timestamp time.Time
	Line      string
}

func (e *Entry) UnmarshalJSON(b []byte) error {
	var values []string

	if err := json.Unmarshal(b, &values); err != nil {
		return err
	}

	if len(values) < 2 {
		return fmt.Errorf("invalid Loki entry: expected [timestamp, line], got %v", values)
	}

	t, err := strconv.ParseInt(values[0], 10, 64)
	if err != nil {
		return err
	}

	e.Timestamp = time.Unix(t, 0)
	e.Line = values[1]

	return nil
}

type Stream struct {
	Stream  map[string]string `json:"stream"`
	Entries []Entry           `json:"values"`
}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the Loki server version and API endpoint compatibility
2. Check the query returns standard log entries
3. Inspect the raw Loki response for unexpected payloads

func looksLikeLokiEntry(raw json.RawMessage) bool {
    var arr []json.RawMessage
    return json.Unmarshal(raw, &arr) == nil && len(arr) >= 2
}

if err := json.Unmarshal(body, &resp); err != nil {
    // also try decoding as LokiQueryRangeResponse to log shape
    log.Errorf("unexpected Loki entry shape: %v", err)
    return err
}

When it happens

Trigger: The Loki query_range or tail API returns a result entry like ["1700000000000000000"] or [] — typically a truncated, hand-crafted, or mocked response body.

Common situations: Pointing the datasource at a non-Loki HTTP endpoint that returns unexpected JSON shapes; test fixtures or proxies rewriting Loki responses.

Related errors

• bad HTTP response code: %d: %s: %w
• error decoding Loki response: %w
• invalid Loki entry: expected [timestamp, line], got %v
• loki query is mandatory
• delay_for should be a value between 1s and 5s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2c393f7ac2b62eb5. Report an issue: GitHub.