nftables and reaction

Hello, I try to execute reaction using nftables instead of iptables. My problem is that I never get ip in my banned set despite the fact that in debug mode with nginx stream I see 2024/01/29 17:22:31 INFO nginx.directus: match [94.102.61.10].

Ex: root@zone-s:/usr/local/bin# reaction show give {}

nftables commands are:

add set inet filter reaction-ban-ip4 { type ipv4_addr; flags interval, timeout; timeout 48h; auto-merge; }

add set inet filter reaction-ban-ip6 { type ipv6_addr; flags interval, timeout; timeout 48h; auto-merge; }

add rule inet filter input ip saddr @reaction-ban-ip4 drop comment " works in all cases of 'chain input policy'"

add rule inet filter input ip6 saddr @reaction-ban-ip6 drop comment " works in all cases of 'chain input policy'"

jsonnet config file

reaction.jsonnet

Notice that I have to split ipv4 and ipv6 to adapt the rules to nft. In this file, you will see cmd which is iptables(['add', 'element', 'inet', 'filter', 'reaction-ban-ip4', '{}']). Would it be possible that the last parameter could be the problem, eg {} which are mandatory to nft are treated before by jsonnet or go ? For the above example for nginx, the applied nft rule should be

nft add element inet filter reaction-ban-ip4 {94.102.61.10}

Thanks for any hint