crowdsecurity/crowdsec · error

jsonExtractType: %s : %w

Error message

jsonExtractType: %s : %w

What it means

When jsonparser fails for a reason other than KeyPathNotFoundError while extracting the dotted path (e.g. malformed JSON, unexpected token), jsonExtractType wraps the underlying error with the target path and returns it. It signals the blob itself could not be parsed at that path, not merely a missing key.

Source

Thrown at pkg/exprhelpers/jsonextract.go:101

func jsonExtractType(jsblob string, target string, t jsonparser.ValueType) ([]byte, error) {
	if !strings.HasPrefix(target, "[") {
		target = strings.ReplaceAll(target, "[", ".[")
	}
	fullpath := strings.Split(target, ".")

	log.Tracef("extract path %+v", fullpath)

	value, dataType, _, err := jsonparser.Get(
		jsonparser.StringToBytes(jsblob),
		fullpath...,
	)
	if err != nil {
		if errors.Is(err, jsonparser.KeyPathNotFoundError) {
			log.Debugf("Key %+v doesn't exist", target)
			return nil, fmt.Errorf("key %s does not exist", target)
		}
		log.Errorf("jsonExtractType : %s : %s", target, err)
		return nil, fmt.Errorf("jsonExtractType: %s : %w", target, err)
	}

	if dataType != t {
		log.Errorf("jsonExtractType : expected type %s for target %s but found %s", t, target, dataType.String())
		return nil, fmt.Errorf("jsonExtractType: expected type %s for target %s but found %s", t, target, dataType.String())
	}

	return value, nil
}

// func JsonExtractSlice(jsblob string, target string) []interface{} {
func JsonExtractSlice(params ...any) (any, error) {
	jsblob := params[0].(string)
	target := params[1].(string)

	value, err := jsonExtractType(jsblob, target, jsonparser.Array)
	if err != nil {
		log.Errorf("JsonExtractSlice : %s", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Validate the blob parses as JSON (json.Valid) before extraction
2. Log/inspect the raw input when this error appears — it indicates corrupt or non-JSON data
3. Handle the wrapped error upstream and fall back to an empty result
4. Fix the data source so only well-formed JSON reaches the expression

Example fix

// before
val, _ := JsonExtractObject(rawLine, "payload")
// after
if !json.Valid([]byte(rawLine)) {
    return nil, fmt.Errorf("not valid JSON")
}
val, err := JsonExtractObject(rawLine, "payload")

if !json.Valid([]byte(jsblob)) {
    return errors.New("input is not valid JSON")
}

val, err := exprhelpers.JsonExtractObject(jsblob, target)
if err != nil && strings.HasPrefix(err.Error(), "jsonExtractType:") {
    log.Errorf("bad blob for %s: %v", target, err)
    return map[string]any{}, nil
}

When it happens

Trigger: Calling JsonExtractSlice/JsonExtractObject on jsblob that is not valid JSON, truncated output, empty string, or an earlier path segment resolving to a scalar so the rest of the path cannot be traversed.

Common situations: Feeding raw (non-JSON) log lines into the extractor; parsing partial responses cut off by network errors; concatenating JSON fragments.

Understand the failure class

Background: JSON parse error: "Unexpected token" / "not valid JSON" / "failed to parse" — what JSON parsers are really complaining about — this error's family across 45 libraries.

Related errors

• missing: %w
• failed to parse JSON line in %s: %w
• missing mandatory 'name' field in %s: %s
• failed to parse JSON line in %s: %w
• key %s does not exist

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2a25a0325dcfd93c. Report an issue: GitHub.