crowdsecurity/crowdsec · warning

unable to parse type

Error message

unable to parse type

What it means

ParseType is a sentinel error meaning a filter value has the wrong type for its key: alertPredicatesFromFilter expected something parseable (e.g. a boolean for 'has_active_decision') but strconv.ParseBool rejected the string. It is the crowdsec filter-language equivalent of a type mismatch.

Source

Thrown at pkg/database/errors.go:18

package database

import "errors"

var (
	UserExists        = errors.New("user already exist")
	UserNotExists     = errors.New("user doesn't exist")
	HashError         = errors.New("unable to hash")
	InsertFail        = errors.New("unable to insert row")
	QueryFail         = errors.New("unable to query")
	UpdateFail        = errors.New("unable to update")
	DeleteFail        = errors.New("unable to delete")
	ItemNotFound      = errors.New("object not found")
	ParseTimeFail     = errors.New("unable to parse time")
	ParseDurationFail = errors.New("unable to parse duration")
	MarshalFail       = errors.New("unable to serialize")
	BulkError         = errors.New("unable to insert bulk")
	ParseType         = errors.New("unable to parse type")
	InvalidIPOrRange  = errors.New("invalid ip address / range")
	InvalidFilter     = errors.New("invalid filter")
)

View on GitHub (pinned to 909b515798)

Solutions

1. Use strconv.ParseBool-accepted values: 1, t, T, TRUE, true, True, 0, f, F, FALSE, false, False.
2. Trim and URL-encode filter values properly when building the query string.
3. Check the wrapped inner error for the offending value echoed in the message.
4. Consult the LAPI filter docs for each key's expected type before querying.

Example fix

// before
filter := "has_active_decision=yes"
// after
filter := "has_active_decision=true"

// Go: validate boolean filter values before querying
func validBoolFilter(s string) bool {
    _, err := strconv.ParseBool(s)
    return err == nil
}

alerts, err := client.ListAlerts(ctx, filter)
if err != nil {
    if errors.Is(err, database.ParseType) {
        return fmt.Errorf("filter value type wrong: %w", err)
    }
    return err
}

When it happens

Trigger: Querying alerts with filter has_active_decision set to a non-boolean string like "yes", "1a" or "true " (trailing space) via LAPI /v1/alerts.

Common situations: Bouncers or scripts building alert queries with human-style booleans (yes/no, on/off), URL-encoded filters with stray whitespace, API consumers guessing value formats instead of using the documented ones.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unable to parse time
• unable to parse duration
• invalid ip address / range
• invalid filter
• no database configuration provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9a74f6d9054ed89d. Report an issue: GitHub.