crowdsecurity/crowdsec · error

unknown transform '%s'

Error message

unknown transform '%s'

What it means

A string in rule.Transform is not a key of transformMap (the transform→modsecurity transform mapping, e.g. lowercase, urldecode). The custom rule asks for a transformation the converter cannot translate; the literal 'count' is filtered out earlier when hasCount is set.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:388

		r.WriteString(",deny")
	}

	r.WriteString(fmt.Sprintf(`,log,msg:'%s',tag:'crowdsec-%s',tag:'cs-custom-rule'`, msg, appsecRuleName))

	if severity != "" && opts.root {
		r.WriteString(fmt.Sprintf(`,severity:'%s'`, severity))
	}

	for _, transform := range rule.Transform {
		if transform == "" || (hasCount && transform == "count") {
			continue
		}

		r.WriteByte(',')

		mappedTransform, ok := transformMap[transform]
		if !ok {
			return "", fmt.Errorf("unknown transform '%s'", transform)
		}

		r.WriteString(mappedTransform)
	}

	if rule.BodyType != "" {
		mappedBodyType, ok := bodyTypeMatch[rule.BodyType]
		if !ok {
			return "", fmt.Errorf("unknown body type '%s'", rule.BodyType)
		}

		r.WriteString(fmt.Sprintf(",ctl:requestBodyProcessor=%s", mappedBodyType))
	}

	if opts.chain {
		r.WriteString(",chain")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Remove or fix the transform entry to a documented one (lowercase, uppercase, urldecode, trim, ...)
2. Verify the transform list against the installed crowdsec version's supported set

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/modsecurity.go:388 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f7a11e3b52887906. Report an issue: GitHub.