crowdsecurity/crowdsec · error

unable to parse %s as unix timestamp

Error message

unable to parse %s as unix timestamp

What it means

ParseUnixTime parses a string containing a Unix timestamp (seconds, optional fractional part stripped) into time.Time. It returns this error when the string cannot be parsed as a base-10 integer or when the value is <= 0, both of which cannot represent a valid Unix timestamp.

Source

Thrown at pkg/exprhelpers/helpers.go:867

func LookupHost(params ...any) (any, error) {
	value := params[0].(string)

	addresses, err := net.LookupHost(value)
	if err != nil {
		log.Errorf("Failed to lookup host '%s' : %s", value, err)
		return []string{}, nil
	}

	return addresses, nil
}

// func ParseUnixTime(value string) (time.Time, error) {
func ParseUnixTime(params ...any) (any, error) {
	value := params[0].(string)
	// Splitting string here as some unix timestamp may have milliseconds and break ParseInt
	i, err := strconv.ParseInt(strings.Split(value, ".")[0], 10, 64)
	if err != nil || i <= 0 {
		return time.Time{}, fmt.Errorf("unable to parse %s as unix timestamp", value)
	}

	return time.Unix(i, 0), nil
}

// func ParseUnix(value string) string {
func ParseUnix(params ...any) (any, error) {
	value := params[0].(string)

	t, err := ParseUnixTime(value)
	if err != nil {
		log.Error(err)
		return "", nil
	}

	return t.(time.Time).Format(time.RFC3339), nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the field actually contains a numeric Unix timestamp string (e.g. '1700000000')
2. Pre-parse with a parser node or ParseInt before calling ParseUnixTime, or use ParseDate for formatted dates
3. Handle millisecond timestamps by keeping them as strings — ParseUnixTime splits on '.' only for fractional seconds
4. Guard against empty/zero values with a condition in the expression

Example fix

// before
ParseUnixTime(evt.Time) // 'Time' is a formatted date
// after
ParseUnixTime(evt.Timestamp) // '1700000000.123'

// expr: numeric string check
// evt.ts != nil && evt.ts != ""

func isUnixTimestampString(s string) bool {
	if s == "" { return false }
	_, err := strconv.ParseInt(strings.Split(s, ".")[0], 10, 64)
	return err == nil
}

// wrap expression evaluation errors:
if _, err := expr.Eval(code, env); err != nil {
	log.Warnf("ParseUnixTime failed: %v", err)
}

When it happens

Trigger: ParseUnixTime('abc'), ParseUnixTime('') , ParseUnixTime('0') or a negative value, or a value with non-numeric characters before the first '.' passed from an event field in an expression.

Common situations: Log field contains a formatted date instead of a Unix epoch; empty field because the regex capture missed; timestamps in milliseconds as a full integer (works, but >0) vs plain '0' placeholders; human-readable dates fed in by mistake.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• timestamp is not valid
• lat1 is not a float : %v
• long1 is not a float : %v
• lat2 is not a float : %v
• long2 is not a float : %v

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/52ac95b1411641f3. Report an issue: GitHub.