Unmarshal JSON warnings

Just noticed these unmarshalJSON warnings/errors by executing docker logs -f crowdsec

time="2025-08-02T19:12:53+10:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:12:53+10:00" level=error msg="UnmarshalJSON : invalid character 'u' looking for beginning of value" line="uestMethod\":\"POST\",\"RequestPath\":\"/plugins/unassigned.devices.preclear/include/Preclear.php\",\"RequestPort\":\"-\",\"RequestProtocol\":\"HTTP/2.0\",\"RequestScheme\":\"https\",\"RetryAttempts\":0,\"RouterName\":\"apollo@file\",\"ServiceAddr\":\"10.0.0.100:8088\",\"ServiceName\":\"apollo@file\",\"ServiceURL\":\"http://10.0.0.100:8088/\",\"StartLocal\":\"2025-08-02T19:12:53.673292055+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:12:53+10:00\"}"

time="2025-08-02T19:12:53+10:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:12:53+10:00" level=error msg="UnmarshalJSON : invalid character 'u' looking for beginning of value" line="uestMethod\":\"POST\",\"RequestPath\":\"/plugins/unassigned.devices.preclear/include/Preclear.php\",\"RequestPort\":\"-\",\"RequestProtocol\":\"HTTP/2.0\",\"RequestScheme\":\"https\",\"RetryAttempts\":0,\"RouterName\":\"apollo@file\",\"ServiceAddr\":\"10.0.0.100:8088\",\"ServiceName\":\"apollo@file\",\"ServiceURL\":\"http://10.0.0.100:8088/\",\"StartLocal\":\"2025-08-02T19:12:53.673292055+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:12:53+10:00\"}"

traefik access log config note, traefik logs log to a seperate file which are not ingested into crowdsec

accesslog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299"
      - "400-599"
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop
    names:
      StartUTC: drop
      User-Agent: keep

accesslog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299"
      - "400-599"
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop
    names:
      StartUTC: drop
      User-Agent: keep

acquis.yaml

filenames:
  - /var/log/traefik/access.log*
labels:
  type: traefik

filenames:
  - /var/log/traefik/access.log*
labels:
  type: traefik

4 Replies

CrowdSec•4w ago

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

seannob86OP•4w ago

Additional examples:

time="2025-08-02T19:12:53+10:00" level=warning msg="failed to run filter : invalid character 'u' looking for beginning of value (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:13:05+10:00" level=error msg="UnmarshalJSON : unexpected end of JSON input" line="{\"ClientAddr\":\"10.0.0.100:54604\",\"ClientHost\":\"10.0.0.100\",\"ClientPort\":\"54604\",\"ClientUsername\":\"-\",\"DownstreamContentSize\":68,\"DownstreamStatus\":200,\"Duration\":2513654,\"Origi"
time="2025-08-02T19:13:05+10:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:13:05+10:00" level=error msg="UnmarshalJSON : invalid character 'C' in literal null (expecting 'u')" line="nContentSize\":68,\"OriginDuration\":2410167,\"OriginStatus\":200,\"Overhead\":103487,\"RequestAddr\":\"pics.seanob.dev\",\"RequestContentSize\":0,\"RequestCount\":750,\"RequestHost\":\"pics.seanob.dev\",\"RequestMethod\":\"GET\",\"RequestPath\":\"/api/server/version-check\",\"RequestPort\":\"-\",\"RequestProtocol\":\"HTTP/1.1\",\"RequestScheme\":\"https\",\"RetryAttempts\":0,\"RouterName\":\"immich-internal@docker\",\"ServiceAddr\":\"172.18.2.5:2283\",\"ServiceName\":\"immich-internal@docker\",\"ServiceURL\":\"http://172.18.2.5:2283\",\"StartLocal\":\"2025-08-02T19:13:05.045561358+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:13:05+10:00\"}"

time="2025-08-02T19:12:53+10:00" level=warning msg="failed to run filter : invalid character 'u' looking for beginning of value (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:13:05+10:00" level=error msg="UnmarshalJSON : unexpected end of JSON input" line="{\"ClientAddr\":\"10.0.0.100:54604\",\"ClientHost\":\"10.0.0.100\",\"ClientPort\":\"54604\",\"ClientUsername\":\"-\",\"DownstreamContentSize\":68,\"DownstreamStatus\":200,\"Duration\":2513654,\"Origi"
time="2025-08-02T19:13:05+10:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:13:05+10:00" level=error msg="UnmarshalJSON : invalid character 'C' in literal null (expecting 'u')" line="nContentSize\":68,\"OriginDuration\":2410167,\"OriginStatus\":200,\"Overhead\":103487,\"RequestAddr\":\"pics.seanob.dev\",\"RequestContentSize\":0,\"RequestCount\":750,\"RequestHost\":\"pics.seanob.dev\",\"RequestMethod\":\"GET\",\"RequestPath\":\"/api/server/version-check\",\"RequestPort\":\"-\",\"RequestProtocol\":\"HTTP/1.1\",\"RequestScheme\":\"https\",\"RetryAttempts\":0,\"RouterName\":\"immich-internal@docker\",\"ServiceAddr\":\"172.18.2.5:2283\",\"ServiceName\":\"immich-internal@docker\",\"ServiceURL\":\"http://172.18.2.5:2283\",\"StartLocal\":\"2025-08-02T19:13:05.045561358+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:13:05+10:00\"}"

crowdsec log:

time="2025-08-02T19:52:08+10:00" level=error msg="UnmarshalJSON : invalid character 'c' looking for beginning of value" line="clear/include/Preclear.php\",\"RequestPort\":\"-\",\"RequestProtocol\":\"HTTP/2.0\",\"RequestScheme\":\"https\",\"RetryAttempts\":0,\"RouterName\":\"apollo@file\",\"ServiceAddr\":\"10.0.0.100:8088\",\"ServiceName\":\"apollo@file\",\"ServiceURL\":\"http://10.0.0.100:8088/\",\"StartLocal\":\"2025-08-02T19:52:08.663350014+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:52:08+10:00\"}"

matched against this in traefik access log

{"ClientAddr":"100.64.0.8:51904","ClientHost":"100.64.0.8","ClientPort":"51904","ClientUsername":"-","DownstreamContentSize":365,"DownstreamStatus":200,"Duration":89154251,"OriginContentSize":365,"OriginDuration":88998039,"OriginStatus":200,"Overhead":156212,"RequestAddr":"apollo.internal","RequestContentSize":100,"RequestCount":114,"RequestHost":"apollo.internal","RequestMethod":"POST","RequestPath":"/plugins/unassigned.devices.preclear/include/Preclear.php","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"apollo@file","ServiceAddr":"10.0.0.100:8088","ServiceName":"apollo@file","ServiceURL":"http://10.0.0.100:8088/","StartLocal":"2025-08-02T19:52:08.663350014+10:00","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"https","level":"info","msg":"","time":"2025-08-02T19:52:08+10:00"}

chatgpt is saying that Crowdsec is receiving only a broken fragment of it: line="clear/include/Preclear.php\",\"RequestPort\":\"-\",... Which starts mid-string (clear/include/...) instead of at the beginning ({...}), and that’s why you get: UnmarshalJSON : invalid character 'c' looking for beginning of value

CrowdSec•4w ago

Resolving Unmarshal JSON warnings This has now been resolved. If you think this is a mistake please run /unresolve

seannob86OP•4w ago

Resolved. Was an issue mounting traefik logs on unraid FUSE rather then directly on cache (which is where crowdsec had the logs mounted)

Gaming

Programming

Unmarshal JSON warnings

Did you find this page helpful?