apache/skywalking · error · IllegalStateException

Failed to compile MAL filter expression: {}

Error message

Failed to compile MAL filter expression: {}

What it means

IllegalStateException from the FilterExpression constructor when GENERATOR.compileFilter(literal) throws for the 'filter:' clause of a MAL rule. The filter sub-language (label matchers) is compiled ahead of data ingestion via a code generator; any lexer/parser/generator failure inside that compile is wrapped into this single exception that names the offending literal.

Source

Thrown at oap-server/analyzer/meter-analyzer/src/main/java/org/apache/skywalking/oap/meter/analyzer/v2/dsl/FilterExpression.java:95

                if (filterNameHint != null) {
                    perFile.setClassNameHint(filterNameHint);
                }
                perFile.setSourceRef(sourceRef);
                this.malFilter = perFile.compileFilter(literal);
            } else {
                if (filterNameHint != null) {
                    GENERATOR.setClassNameHint(filterNameHint);
                }
                GENERATOR.setSourceRef(sourceRef);
                try {
                    this.malFilter = GENERATOR.compileFilter(literal);
                } finally {
                    GENERATOR.setClassNameHint(null);
                    GENERATOR.setYamlSource(null);
                }
            }
        } catch (Exception e) {
            throw new IllegalStateException(
                "Failed to compile MAL filter expression: " + literal, e);
        }
    }

    public Map<String, SampleFamily> filter(final Map<String, SampleFamily> sampleFamilies) {
        try {
            final Map<String, SampleFamily> result = new HashMap<>();
            for (final Map.Entry<String, SampleFamily> entry : sampleFamilies.entrySet()) {
                final SampleFamily afterFilter = entry.getValue().filter(malFilter::test);
                if (!Objects.equals(afterFilter, SampleFamily.EMPTY)) {
                    result.put(entry.getKey(), afterFilter);
                }
            }
            return result;
        } catch (Throwable t) {
            log.error("failed to run \"{}\"", literal, t);
        }
        return sampleFamilies;

View on GitHub (pinned to 102af09b4a)

Solutions

1. Read the wrapped cause (the IllegalStateException carries the original exception) — it pinpoints the exact filter syntax problem
2. Compare the filter literal against the MAL filter grammar/examples in docs/en/concepts-and-designs/meter-analysis-language.md and fix the syntax
3. Test the filter expression in a unit test that constructs FilterExpression directly so failures surface before OAP deploy
4. If the label name is wrong, verify the label actually exists on the ingested samples (typo'd label names compile but never match — while structural typos fail compile)

Example fix

# before
filter: 'src_service_name == "gateway" && status_code" == 500'
# after
filter: src_service_name == "gateway" && status_code == 500

try {
    FilterExpression fe = new FilterExpression(literal);
} catch (IllegalStateException e) {
    // e.getCause() carries the generator's precise syntax error
    log.error("Bad MAL filter '{}': {}", literal, e.getCause().getMessage());
}

When it happens

Trigger: A syntax error in the filter: field of a MAL rule YAML, e.g. unbalanced quotes, an unknown label-matcher operator, or a filter literal the v2 filter grammar does not accept. Raised at rule-load time (OAP startup or dynamic rule reload), before any samples are processed.

Common situations: Hand-editing filter expressions; copying a PromQL label matcher (e.g. '{job="x"}' or '=~' regex forms) that the MAL filter grammar spells differently; version upgrades that changed the accepted filter syntax while the rule file was not updated.

Related errors

• {}: one of service(), instance() or endpoint() should be inv
• Load rule {} failed
• phase-2 register failed for {}
• MAL filter expression parsing failed: {} in expression: {}
• Load rule file {} failed

AI-assisted analysis of apache/skywalking@102af09b4a (2026-08-14). Data as JSON: /api/errors/ef7d6ab52791501b. Report an issue: GitHub.