crowdsecurity/crowdsec · error

unable to serialize

Error message

unable to serialize

What it means

MarshalFail is a sentinel error meaning JSON serialization of event metadata failed. buildEventCreates marshals each event's Meta map to store it in the events table; any value in the map that json.Marshal cannot serialize (channels, funcs, invalid nested types) triggers it.

Source

Thrown at pkg/database/errors.go:16

package database

import "errors"

var (
	UserExists        = errors.New("user already exist")
	UserNotExists     = errors.New("user doesn't exist")
	HashError         = errors.New("unable to hash")
	InsertFail        = errors.New("unable to insert row")
	QueryFail         = errors.New("unable to query")
	UpdateFail        = errors.New("unable to update")
	DeleteFail        = errors.New("unable to delete")
	ItemNotFound      = errors.New("object not found")
	ParseTimeFail     = errors.New("unable to parse time")
	ParseDurationFail = errors.New("unable to parse duration")
	MarshalFail       = errors.New("unable to serialize")
	BulkError         = errors.New("unable to insert bulk")
	ParseType         = errors.New("unable to parse type")
	InvalidIPOrRange  = errors.New("invalid ip address / range")
	InvalidFilter     = errors.New("invalid filter")
)

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure Meta values are JSON-primitives (string, number, bool, nil) or composites of them.
2. Inspect the wrapped inner error, which names the offending value: json: unsupported type: ...
3. Sanitize Meta in the parser: convert unknown values with fmt.Sprintf("%v", v) before adding.
4. If forking, avoid storing Go-native objects in Meta; keep it a map[string]string.

Example fix

// before
meta := models.Meta{"raw": someFuncValue}
// after
meta := models.Meta{"raw": fmt.Sprintf("%v", someValue)}

// Go: ensure Meta values are JSON-encodable before ingestion
func jsonSafe(meta models.Meta) error {
    _, err := json.Marshal(meta)
    return err
}

if _, err := client.CreateAlert(ctx, alert); err != nil {
    if errors.Is(err, database.MarshalFail) {
        log.Errorf("non-serializable meta: %v", err)
        return sanitizeMetaAndRetry(alert)
    }
    return err
}

When it happens

Trigger: CreateAlert/buildEventCreates when an event's Meta contains non-JSON-serializable values or cyclic structures, e.g. a custom parser stuffing odd types into event.Meta.

Common situations: Parsers producing meta values of exotic Go types (float NaN is fine, but funcs/channels are not), plugins or post-parsers injecting non-primitive values, custom forked code altering Meta types.

Understand the failure class

Background: "JSON serialization failed", "not JSON serializable", "Failed to serialize": why JSON marshaling errors happen and how to fix them — this error's family across 46 libraries.

Related errors

• event meta '%v': %w: %w
• no database configuration provided
• unable to update
• unable to delete
• object not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/899ae7f8d9601b89. Report an issue: GitHub.