Error message which cannot be categorised - msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"

1

Hi team,

Between X-Mas and New Year’s Eve there is time for some housekeeping :upside_down_face:

Running the latest version of crowdsec (1.5.5) on a Linux server (not dockerized), I receive:

time="28-12-2023 00:51:16" level=error msg="jsonExtractLib : [alert signature] : Value is string, but can't find closing '\"' symbol"
time="28-12-2023 02:43:19" level=error msg="jsonExtractLib : [dest_ip] : Value is string, but can't find closing '\"' symbol"
time="28-12-2023 03:04:09" level=error msg="jsonExtractLib : [alert signature] : Value is string, but can't find closing '\"' symbol"
time="28-12-2023 03:17:39" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"
time="28-12-2023 05:45:32" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"
time="28-12-2023 13:50:05" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"
time="29-12-2023 02:27:06" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"
time="29-12-2023 02:51:46" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"
time="29-12-2023 10:12:42" level=error msg="jsonExtractLib : [event_type] : Value is string, but can't find closing '\"' symbol"

… as you can see, several times a day.

Any ideas?

2

Can you provide which logs these are?

We have been moving away from jsonExtractLib could you make sure your parsers and scenarios are up to date?