{"record":{"id":"1db7e8acf3a62a38","repo":"crowdsecurity/crowdsec","slug":"while-running-expression-s-w","errorCode":null,"errorMessage":"while running expression %s: %w","messagePattern":"while running expression (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csprofiles/csprofiles.go","lineNumber":181,"sourceCode":"\treturn decisions, nil\n}\n\n// EvaluateProfile is going to evaluate an Alert against a profile to generate Decisions\nfunc (profile *Runtime) EvaluateProfile(alert *models.Alert) ([]*models.Decision, bool, error) {\n\tvar decisions []*models.Decision\n\n\tmatched := false\n\n\tfor eIdx, expression := range profile.RuntimeFilters {\n\t\tdebugProfile := false\n\t\tif profile.Cfg.Debug != nil && *profile.Cfg.Debug {\n\t\t\tdebugProfile = true\n\t\t}\n\n\t\toutput, err := exprhelpers.Run(expression, map[string]interface{}{\"Alert\": alert}, profile.Logger, debugProfile)\n\t\tif err != nil {\n\t\t\tprofile.Logger.Warningf(\"failed to run profile expr for %s: %v\", profile.Cfg.Name, err)\n\t\t\treturn nil, matched, fmt.Errorf(\"while running expression %s: %w\", profile.Cfg.Filters[eIdx], err)\n\t\t}\n\n\t\tswitch out := output.(type) {\n\t\tcase bool:\n\t\t\tif out {\n\t\t\t\tmatched = true\n\t\t\t\t/*the expression matched, create the associated decision*/\n\t\t\t\tsubdecisions, err := profile.GenerateDecisionFromProfile(alert)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, matched, fmt.Errorf(\"while generating decision from profile %s: %w\", profile.Cfg.Name, err)\n\t\t\t\t}\n\n\t\t\t\tdecisions = append(decisions, subdecisions...)\n\t\t\t} else {\n\t\t\t\tprofile.Logger.Debugf(\"Profile %s filter is unsuccessful\", profile.Cfg.Name)\n\n\t\t\t\tif profile.Cfg.OnFailure == \"break\" {\n\t\t\t\t\tbreak","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csprofiles/csprofiles.go#L163-L199","documentation":"EvaluateProfile runs each profile filter expression against an Alert using exprhelpers.Run. If the expression engine itself fails at runtime (not merely returning false) — e.g. a type error evaluating a field, nil dereference in the expr VM, or an environment problem — the error is wrapped as 'while running expression <filter>: ...' and EvaluateProfile returns no decisions.","triggerScenarios":"Calling EvaluateProfile with a profile whose filter compiles but fails at evaluation: accessing a nil Alert field in a way expr can't handle, applying an operator to mismatched types (e.g. comparing string to int), or a registered helper panicking/erroring at runtime.","commonSituations":"Filters written against an older Alert schema (field renamed/moved); expressions using Regexp() or File() helpers whose registration failed; alerts missing fields the filter assumes (e.g. nil Event whitelist entry).","solutions":["Read the wrapped inner error from the log line 'failed to run profile expr' to identify the failing sub-expression.","Validate the filter expr against a real Alert payload with debug enabled (CROWDSEC_DEBUG or debug: true).","Fix type mismatches in the filter (quote strings, cast numbers).","Update expressions to match the current models.Alert schema after upgrading CrowdSec."],"exampleFix":"// before (profiles.yaml filter)\nfilter: Alert.Source.IP == 1.2.3.4\n// after\nfilter: \"Alert.Source.IP in ['1.2.3.4']\"","handlingStrategy":"try-catch","validationCode":"// compile-check filters up front\nfor _, f := range profile.Filters {\n    if _, err := expr.Compile(f, exprhelpers.GetExprOptions(map[string]interface{}{\"Alert\": &models.Alert{}})...); err != nil {\n        return fmt.Errorf(\"invalid filter %q: %w\", f, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"decisions, matched, err := profile.EvaluateProfile(alert)\nif err != nil {\n    log.Warnf(\"profile evaluation failed, no decisions applied: %v\", err)\n    return\n}","preventionTips":["Re-validate filters after CrowdSec upgrades (Alert schema changes)","Enable debug logging while authoring filters","Test filters against realistic alert payloads"],"tags":["expr","profile","runtime"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}