Failed to bind to json

[ocean token]

Hi all,

I noticed this message being spammed in my docker logs....

crowdsec  | 2025-09-29T13:30:02.980877960Z time="2025-09-29T15:30:02+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T13:45:02.987422639Z time="2025-09-29T15:45:02+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T14:00:02.994870485Z time="2025-09-29T16:00:02+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T14:15:03.005988061Z time="2025-09-29T16:15:03+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T14:30:03.015941612Z time="2025-09-29T16:30:03+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T14:45:03.023907445Z time="2025-09-29T16:45:03+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics
crowdsec  | 2025-09-29T15:00:03.031093964Z time="2025-09-29T17:00:03+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.metrics.items of type []*models.MetricsDetailItem" func=UsageMetrics

I honestly have no clue where to start....

[blissful copper]

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

© Created By WhyAydan for CrowdSec ❤️ · Sep 29, 2025, 3:06 PM

[ocean token]

The error is sent in the 'main server' docker. It's a distributed setup, and the only bouncers I have active at the moment of errors are Openresty.

[little surge]

So you have a central LAPI that openresty is talking too?

[ocean token]

correct

Sorry, my head is all over the place rn. Can't compose a decent sentence

[little surge]

can you check the api logs?

ohh wait your inside a container

it should be the same stdout

[ocean token]

When filtering on 'error' these are the only lines I see in the last 5000 logs

Anything else I should look for?

[little surge]

can you grep for "500" status code?

[ocean token]

Can't find any

[little surge]

which openresty / remediation version are you on?

looking at the code we return 400 status code not 500

[ocean token]

Latest normally, lemme check

crowdsec-openresty-bouncer v1.1.1

192.168.202.4 & 192.168.202.5 are my openresty nodes

[little surge]

So we have a little bit of a dilema, we need to enable debug logs on openresty but to do so would need a restart and then the metrics its currently trying to push will be lost so will most likely resolve itself.

[ocean token]

So you think a restart of the openrest node should fix the issue? 'Cause that server has been restarted sometimes in the last couple of days

[little surge]

Yeah it should, unless the metrics are completely broken but the same system is within nginx and I have it running / havent encountered this.

[ocean token]

I'll fully reboot both servers and follow it up...

[ocean token]

After rebooting the issue is back

[cerulean parrot]

Can you add debug at the end of your error_log directive and restart openresty ?
This will make the bouncer output debug logs, including the payload sent to LAPI for the metrics (it will spam quite a bit when a request is checked tho)

[ocean token]

Like so right? In the openresty/nginx config:

    # Openresty log files
    error_log "/var/log/nginx/error.log" debug;
    access_log "/var/log/nginx/access.log";

[cerulean parrot]

yes

[ocean token]

Okay, I'm monitoring. Will wait for a new alert to trigger I suppose?

[cerulean parrot]

Yes, the bouncer pushes its metrics every 15 minutes

[cerulean parrot]

and did you see the error in crowdsec logs at the same time ?

[ocean token]

nope

All errors filtered out

[ocean token]

Any thoughts?

[ocean token]

bump

[ocean token]

bump

[cerulean parrot]

Without seeing the payload the bouncer tries to send when the error occurs, it's hard to say.

The debug log you pasted previously showed a normal JSON payload for the metrics (and I have no issue decoding it to our internal struct when testing it)