{"record":{"id":"00f39a66302abc78","repo":"crowdsecurity/crowdsec","slug":"unable-to-compile-filter-s-w","errorCode":null,"errorMessage":"unable to compile filter %s : %w","messagePattern":"unable to compile filter (.+?) : %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":163,"sourceCode":"\t\tenv = GetPreEvalEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})\n\tcase hookPostEval:\n\t\tenv = GetPostEvalEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})\n\tcase hookOnMatch:\n\t\tenv = GetOnMatchEnv(&AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{}, pipeline.Event{})\n\tcase hookOnChallenge:\n\t\tenv = GetOnChallengeEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})\n\tcase hookOnChallengeSubmit:\n\t\tenv = GetOnChallengeSubmitEnv(&AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})\n\t}\n\n\topts := exprhelpers.GetExprOptions(env)\n\tif patcher != nil {\n\t\topts = append(opts, expr.Patch(patcher))\n\t}\n\tif h.Filter != \"\" {\n\t\tprogram, err := expr.Compile(h.Filter, opts...) // FIXME: opts\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to compile filter %s : %w\", h.Filter, err)\n\t\t}\n\n\t\th.FilterExpr = program\n\t}\n\n\tfor _, apply := range h.Apply {\n\t\tprogram, err := expr.Compile(apply, opts...)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to compile apply %s : %w\", apply, err)\n\t\t}\n\n\t\th.ApplyExpr = append(h.ApplyExpr, program)\n\t}\n\n\treturn nil\n}\n\ntype AppsecTempResponse struct {","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L145-L181","documentation":"Hook.Build compiles the hook's `filter` expression with the go-expr compiler, using the AppSec expression environment and optional patcher. If the expression has syntax errors or references unknown identifiers/functions, compilation fails and the whole hook cannot be built. This is a configuration-time error: an AppSec rule/hook with an invalid expr filter expression.","triggerScenarios":"Calling Hook.Build with h.Filter set to an expression that fails expr.Compile — syntax errors, unknown variables not in the AppSec variable map, or wrong argument count to expr functions.","commonSituations":"Typo in a variable name in an appsec-config rule (e.g. 'tx.foo' vs 'vars.foo'); using functions not registered in the AppSec expr helpers; copy-pasted expression from another CrowdSec component with a different expr environment; unbalanced parentheses.","solutions":["Read the wrapped expr compiler error — it names the exact syntax position or unknown identifier","Test the expression against the AppSec expression environment (see AppsecRules expr helpers docs) with a sample request","Fix the filter expression in the YAML appsec-config file","Reduce the expression to smaller sub-expressions to isolate which part fails to compile"],"exampleFix":"// before (yaml)\nfilter: \"tx.req_contains('bad')\"\n// after\nfilter: \"contains(tx.path, 'bad')\"","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Lint expr filters in CI","Use only documented AppSec variables/functions"],"tags":["expr","appsec","compilation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}