crowdsecurity/crowdsec · error

unknown match type '%s'

Error message

unknown match type '%s'

What it means

The rule's Match.Type string has no entry in matchMap (the match-type→modsecurity operator mapping). The custom rule declares an operator the converter does not know, so it cannot be emitted as a SecRule expression.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:347

		if len(rule.Variables) == 0 {
			r.WriteString(mappedZone)
		} else {
			for j, variable := range rule.Variables {
				if j > 0 {
					r.WriteByte('|')
				}

				r.WriteString(fmt.Sprintf("%s%s:%s%s", zonePrefix, mappedZone, variablePrefix, variable))
			}
		}
	}

	r.WriteByte(' ')

	if rule.Match.Type != "" {
		match, ok := matchMap[rule.Match.Type]
		if !ok {
			return "", fmt.Errorf("unknown match type '%s'", rule.Match.Type)
		}

		prefix := ""
		if rule.Match.Not {
			prefix = "!"
		}

		r.WriteString(fmt.Sprintf(`"%s%s %s"`, prefix, match, rule.Match.Value))
	}

	var msg string
	if appsecRuleDescription != "" {
		msg = appsecRuleDescription
	} else {
		msg = appsecRuleName
	}

	r.WriteString(fmt.Sprintf(` "id:%d,phase:2`, m.generateRuleID(rule, appsecRuleName, opts.position)))

View on GitHub (pinned to 909b515798)

Solutions

1. Set match.type in the custom rule to one of the documented match types (equals, contains, starts_with, ends_with, regex, ...)
2. Check spelling/case against the version's supported match map

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/modsecurity.go:347 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2fb2be7391cbf6f7. Report an issue: GitHub.