{"record":{"id":"0c255e58bf8bdca8","repo":"crowdsecurity/crowdsec","slug":"while-running-expression-s-w-0c255e","errorCode":null,"errorMessage":"while running expression %s: %w","messagePattern":"while running expression (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubtest/parser_assert.go","lineNumber":193,"sourceCode":"\n\t// wrap with basename() in case of datasource_path, for backward compatibility\n\texpression = basenameShim(expression)\n\n\truntimeFilter, err := expr.Compile(expression, opts...)\n\tif err != nil {\n\t\tlogger.Errorf(\"failed to compile '%s': %s\", expression, err)\n\t\treturn output, err\n\t}\n\n\t// dump opcode in trace level\n\tlogger.Tracef(\"%s\", runtimeFilter.Disassemble())\n\n\toutput, err = expr.Run(runtimeFilter, env)\n\tif err != nil {\n\t\tlogger.Warningf(\"running : %s\", expression)\n\t\tlogger.Warningf(\"runtime error: %s\", err)\n\n\t\treturn output, fmt.Errorf(\"while running expression %s: %w\", expression, err)\n\t}\n\n\treturn output, nil\n}\n\nfunc (p *ParserAssert) EvalExpression(expression string) (string, error) {\n\toutput, err := p.RunExpression(expression)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tret, err := yaml.Marshal(output)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn string(ret), nil\n}","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/hubtest/parser_assert.go#L175-L211","documentation":"RunExpression evaluates an expr-lang expression against a runtime environment. When expr.Run fails at runtime (after successful compilation), the error is wrapped with the full expression text and both are logged as warnings. It indicates a runtime evaluation problem: missing map key, wrong type in a function call, or a panic recovered by expr.","triggerScenarios":"EvalExpression or Run invoking RunExpression with an expression referencing fields/functions that error during evaluation against the given env map (nil values, wrong argument types to helper functions like GetWarning(), unavailable runtime fields).","commonSituations":"Assertions or filter expressions run against events that lack expected fields; helper functions called with wrong types; expressions reused across parser versions where the evt structure changed.","solutions":["Log/inspect the event environment (env map) to confirm the fields the expression accesses exist at runtime","Test the expression in the cscli hubtest interactive console to reproduce the runtime error","Guard expression accesses with optional checks or defaults (e.g. evt.Parsed.field ?? '')","Fix the helper function usage signature (types/arg counts)"],"exampleFix":"// before\nevt.Parsed.fts_query\n// after\nevt.Parsed.get('fts_query', '')","handlingStrategy":"try-catch","validationCode":"// compile-check the expression before running against live env\nif _, err := expr.Compile(expression, expr.Env(envMap)); err != nil {\n    return fmt.Errorf(\"invalid expression: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"out, err := p.RunExpression(expression)\nif err != nil {\n    log.Errorf(\"expression %q failed at runtime: %v\", expression, errors.Unwrap(err))\n    return out, err\n}","preventionTips":["Dump the event map (evt.Parsed/evt.Enriched) to confirm field availability","Use map .get() style access with defaults for optional fields","Validate expressions in the cscli hubtest console first","Pin and test against the expr-lang version crowdsec uses"],"tags":["expr","runtime","hubtest"],"backgroundTag":"type-mismatch","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}