{"record":{"id":"013d1ee7c93f9420","repo":"crowdsecurity/crowdsec","slug":"failed-to-compile-node-in-s-s","errorCode":null,"errorMessage":"failed to compile node in '%s' : %s","messagePattern":"failed to compile node in '(.+?)' : (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/stage.go","lineNumber":141,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to check version : %s\", err)\n\t\t}\n\n\t\tif !ok {\n\t\t\tlog.Errorf(\"%s : %s doesn't satisfy parser format %s, skip\", node.Name, node.FormatVersion, constraint.Parser)\n\t\t\tcontinue\n\t\t}\n\n\t\tnode.Stage = stageFile.Stage\n\t\t// compile the node : grok pattern and expression\n\n\t\terr = node.compile(pctx, ectx)\n\t\tif err != nil {\n\t\t\tif node.Name != \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to compile node '%s' in '%s' : %s\", node.Name, stageFile.Filename, err)\n\t\t\t}\n\n\t\t\treturn nil, fmt.Errorf(\"failed to compile node in '%s' : %s\", stageFile.Filename, err)\n\t\t}\n\t\t/* if the stage is empty, the node is empty, it's a trailing entry in users yaml file */\n\t\tif node.Stage == \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tfor _, data := range node.Data {\n\t\t\terr = exprhelpers.FileInit(pctx.DataFolder, data.DestPath, data.Type)\n\t\t\tif err != nil {\n\t\t\t\tlog.Error(err.Error())\n\t\t\t}\n\n\t\t\tif data.Type == \"regexp\" { // cache only makes sense for regexp\n\t\t\t\tif err = exprhelpers.RegexpCacheInit(data.DestPath, *data); err != nil {\n\t\t\t\t\tlog.Error(err.Error())\n\t\t\t\t}\n\t\t\t}\n\t\t}","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/stage.go#L123-L159","documentation":"During loading of a parser stage file, one of the nodes (a filter or a parse/whitelist stanza) failed to compile its expressions or configuration. Since the node has no name, CrowdSec cannot identify it in the message, so it reports only the stage file where the bad node lives. The stage cannot be loaded and parser startup aborts.","triggerScenarios":"LoadStages -> processStageFile reads a stage YAML file and calls node.compile(pctx, ectx); the node returns a compile error (bad expr filter, invalid runtime field expression) and node.Name is empty (e.g. a node defined as a list entry without a 'name' key or a top-level filter/parse map).","commonSituations":"A user-edited parser file in /etc/crowdsec/parsers/... where a node is written in short YAML form (list item) so it carries no name, and its `filter` expression has a typo (unknown field, bad operator), or the `expression` in a statics block is invalid.","solutions":["Open the stage file named in the message and find the unnamed node; give it a `name:` field so future errors identify it.","Validate every expr expression in that node (filter, statics expressions) against the evt pipeline schema; fix typos/unknown fields.","If the node is truly empty (trailing entry in user yaml), remove it — the code deliberately skips nodes whose Stage is empty.","Run `cscli hubtool` or restart crowdsec after each edit to confirm the stage loads."],"exampleFix":"// before (parsers/s02-enrich/example.yaml, unnamed node with bad expr)\n- filter: evt.Parsed.service == 'sshd' and\n  ...\n// after\n- name: example-sshd-node\n  filter: evt.Parsed.program == 'sshd'\n  ...","handlingStrategy":"validation","validationCode":"// before loading stages, lint every node expression\nfor _, f := range stageFiles {\n    nodes := parseNodes(f)\n    for i, n := range nodes {\n        if n.Name == \"\" {\n            log.Warnf(\"%s: node %d has no name; give it one for debuggability\", f, i)\n        }\n        if _, err := expr.Compile(n.Filter, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...); err != nil {\n            return fmt.Errorf(\"%s: node %q bad filter: %w\", f, n.Name, err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := LoadStages(cfg); err != nil {\n    var se *StageError\n    if errors.As(err, &se) { /* stage file se.File, fix node */ }\n    log.Fatalf(\"parser load failed: %v\", err)\n}","preventionTips":["Always give parser nodes an explicit `name:` field.","Test parser changes with `cscli hubtool` before deploying.","Run crowdsec in a staging config dir first; keep user-edited files in version control."],"tags":["parser","config","expr","crowdsec"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}