{"record":{"id":"422157ccb26779df","repo":"crowdsecurity/crowdsec","slug":"compiling-static-expression-q-w","errorCode":null,"errorMessage":"compiling static expression %q: %w","messagePattern":"compiling static expression %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/static.go","lineNumber":62,"sourceCode":"\tif s.Meta == \"\" && s.Parsed == \"\" && s.TargetByName == \"\" {\n\t\treturn errors.New(\"at least one of meta/event/target must be set\")\n\t}\n\n\tif s.Value == \"\" && s.ExpValue == \"\" {\n\t\treturn errors.New(\"value or expression must be set\")\n\t}\n\n\treturn nil\n}\n\nfunc (s *Static) Compile() (*RuntimeStatic, error) {\n\tcs := &RuntimeStatic{Config: s}\n\n\tif s.ExpValue != \"\" {\n\t\tprog, err := expr.Compile(s.ExpValue,\n\t\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"compiling static expression %q: %w\", s.ExpValue, err)\n\t\t}\n\n\t\tcs.RunTimeValue = prog\n\t}\n\n\treturn cs, nil\n}\n","sourceCodeStart":44,"sourceCodeEnd":70,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/static.go#L44-L70","documentation":"Static.Compile() compiles the optional `expression` of a statics entry into an expr program evaluated at runtime to produce the static value. If the expression fails to compile the whole statics config is rejected, with the offending expression quoted.","triggerScenarios":"A statics entry with `expression:` set (in a parser node or enricher statics) contains invalid expr syntax or references unknown fields; Compile is invoked during parser loading.","commonSituations":"Typos in field names (`evt.Parsed.sourceip`), unbalanced parentheses, use of functions not registered in exprhelpers.","solutions":["Look at the expr error under the quoted expression to find the exact syntax problem.","Validate the expression against a real event (debug mode / cscli hubtool) to confirm fields exist.","Fix the `expression:` line and reload; if you want a literal value, use `value:` instead of `expression:`."],"exampleFix":"// before\nstatics:\n  - meta: service\n    expression: evt.Parsed.service == 'ssh' ? 'sshd'\n// after\nstatics:\n  - meta: service\n    expression: evt.Parsed.service == 'ssh' ? 'sshd' : 'other'","handlingStrategy":"try-catch","validationCode":"for _, st := range statics {\n    if st.ExpValue != \"\" {\n        if _, err := expr.Compile(st.ExpValue, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...); err != nil {\n            return fmt.Errorf(\"static %q: %w\", st.ExpValue, err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"rt, err := static.Compile()\nif err != nil {\n    if strings.Contains(err.Error(), \"compiling static expression\") { /* fix expression: */ }\n    return err\n}","preventionTips":["Use `value:` for constants and `expression:` only when dynamic.","Sanity-check expressions in debug mode against live events before deploying."],"tags":["parser","statics","expr","compilation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}