{"record":{"id":"449dd2ffd5fd622a","repo":"crowdsecurity/crowdsec","slug":"static-d-w","errorCode":null,"errorMessage":"static %d: %w","messagePattern":"static (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/node.go","lineNumber":91,"sourceCode":"\n\t/* \"\" behaves like continue */\n\tif n.OnSuccess != \"continue\" && n.OnSuccess != \"next_stage\" && n.OnSuccess != \"\" {\n\t\treturn fmt.Errorf(\"onsuccess %q not continue,next_stage\", n.OnSuccess)\n\t}\n\n\tif n.Filter != \"\" && n.RunTimeFilter == nil {\n\t\treturn fmt.Errorf(\"non-empty filter %q was not compiled\", n.Filter)\n\t}\n\n\tif n.RuntimeGrok.RunTimeRegexp != nil || n.Grok.TargetField != \"\" {\n\t\tif err := n.Grok.Validate(); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tfor idx, static := range n.Statics {\n\t\tif err := static.Validate(ectx); err != nil {\n\t\t\treturn fmt.Errorf(\"static %d: %w\", idx, err)\n\t\t}\n\t}\n\n\tfor idx, stash := range n.Stashes {\n\t\tif err := stash.Validate(); err != nil {\n\t\t\treturn fmt.Errorf(\"stash %d: %w\", idx, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (n *Node) processFilter(cachedExprEnv map[string]any) (bool, error) {\n\tclog := n.Logger\n\tif n.RunTimeFilter == nil {\n\t\tclog.Trace(\"Node has no filter, enter\")\n\t\treturn true, nil\n\t}","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/node.go#L73-L109","documentation":"During node validation each static entry is checked via static.Validate; a failing static is wrapped with its index ('static %d') so the offending entry in the node's statics list can be identified. The inner error (from static.Validate) describes the actual problem, such as an invalid value expression.","triggerScenarios":"validate() iterates n.Statics and calls static.Validate(ectx); any error from a static — e.g. a static with a bad 'value' expr or a invalid target field — gets index-wrapped by this line.","commonSituations":"Custom parser statics block with a malformed expression in 'value'; a static referencing an expr helper that doesn't exist; hub collection statics incompatible with the current crowdsec version.","solutions":["Look at the wrapped inner error and the reported index to find the offending statics entry in the parser YAML.","Fix the static's value: either a literal or a valid expr expression using known evt fields and helpers.","Test the parser config with `cscli hub test` to confirm the static evaluates correctly.","Update or reinstall the hub collection if its statics are broken/outdated."],"exampleFix":"// before (parser yaml)\nstatics:\n  - meta: log_type\n    value: evt.Parsed['type' ==\n// after\nstatics:\n  - meta: log_type\n    value: evt.Parsed.type","handlingStrategy":"validation","validationCode":"for idx, s := range node.Statics {\n    if err := s.Validate(ectx); err != nil {\n        return fmt.Errorf(\"static %d invalid before load: %w\", idx, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := node.Validate(ectx); err != nil {\n    if strings.Contains(err.Error(), \"static \") {\n        var idx int\n        fmt.Sscanf(err.Error(), \"static %d\", &idx)\n        logger.Errorf(\"check statics entry #%d in the parser config: %v\", idx, err)\n    }\n    return err\n}","preventionTips":["Use the wrapped index to locate and fix the exact statics entry in the YAML.","Keep static 'value' fields as literals or verified expr expressions.","Validate parser configs with `cscli hub test` before deployment.","Keep hub collections updated so shipped statics stay compatible."],"tags":["parser","validation","statics","crowdsec"],"backgroundTag":"schema-validation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}