crowdsecurity/crowdsec · error

unknown body type '%s'

Error message

unknown body type '%s'

What it means

rule.BodyType has no entry in bodyTypeMatch (body-type→ctl:requestBodyProcessor mapping, e.g. json, xml). The custom rule requests a request-body processor the converter cannot declare via the ctl action.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:397

	for _, transform := range rule.Transform {
		if transform == "" || (hasCount && transform == "count") {
			continue
		}

		r.WriteByte(',')

		mappedTransform, ok := transformMap[transform]
		if !ok {
			return "", fmt.Errorf("unknown transform '%s'", transform)
		}

		r.WriteString(mappedTransform)
	}

	if rule.BodyType != "" {
		mappedBodyType, ok := bodyTypeMatch[rule.BodyType]
		if !ok {
			return "", fmt.Errorf("unknown body type '%s'", rule.BodyType)
		}

		r.WriteString(fmt.Sprintf(",ctl:requestBodyProcessor=%s", mappedBodyType))
	}

	if opts.chain {
		r.WriteString(",chain")
	}

	if opts.skip > 0 {
		r.WriteString(fmt.Sprintf(",skip:%d", opts.skip))
	}

	r.WriteByte('"')

	return r.String(), nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Set body_type to a documented value (json, xml, urlencoded) or remove it
2. Check the version's bodyTypeMatch for the supported set

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/modsecurity.go:397 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/74655cad87f399e1. Report an issue: GitHub.