{"record":{"id":"5893705fe035e8ed","repo":"crowdsecurity/crowdsec","slug":"compilation-of-q-failed-v","errorCode":null,"errorMessage":"compilation of %q failed: %v","messagePattern":"compilation of %q failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/node.go","lineNumber":436,"sourceCode":"\t} else {\n\t\t/* else bind it to the default one (might find something more elegant here)*/\n\t\tclog = log.WithField(\"module\", \"parser\")\n\t}\n\n\tn.Logger = clog.WithField(\"id\", n.rn)\n\n\t/* display info about top-level nodes, they should be the only one with explicit stage name ?*/\n\tn.Logger = n.Logger.WithFields(log.Fields{\"stage\": n.Stage, \"name\": n.Name})\n\n\tif n.Logger.Logger.IsLevelEnabled(log.TraceLevel) {\n\t\tn.Logger.Tracef(\"Compiling: %s\", dumpr.Sdump(n))\n\t}\n\n\t// compile filter if present\n\tif n.Filter != \"\" {\n\t\tn.RunTimeFilter, err = expr.Compile(n.Filter, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"compilation of %q failed: %v\", n.Filter, err)\n\t\t}\n\t}\n\n\t/* handle pattern_syntax and groks */\n\tfor _, pattern := range n.SubGroks {\n\t\tn.Logger.Tracef(\"Adding subpattern '%s': '%s'\", pattern.Key, pattern.Value)\n\n\t\tif err = pctx.Grok.Add(pattern.Key.(string), pattern.Value.(string)); err != nil {\n\t\t\tif errors.Is(err, grokky.ErrAlreadyExist) {\n\t\t\t\tn.Logger.Warningf(\"grok '%s' already registred\", pattern.Key)\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tn.Logger.Errorf(\"Unable to compile subpattern %s: %v\", pattern.Key, err)\n\n\t\t\treturn err\n\t\t}\n\t}","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/node.go#L418-L454","documentation":"Wraps an Expr (expr-lang) compilation failure for a parser node's filter expression during node compilation. The %q is the raw filter string, and %v is the compiler's syntax/semantic error. Thrown because CrowdSec parses filters into executable expressions at node-compile time and cannot proceed with an uncompilable filter.","triggerScenarios":"Calling node.compile() (from processStageFile or TestParserConfigs) when node.Filter contains invalid expr-lang syntax, references unknown functions, or uses wrong types (e.g. evt.Parsed on a missing field helper).","commonSituations":"Typos in filter expressions, using functions not registered via exprhelpers, quoting mistakes in YAML, expressions valid in a newer/older expr version than the one shipped.","solutions":["Read the wrapped %v from expr.Compile for the exact syntax error and line position","Validate the expression independently with expr-lang syntax checks or `cscli hubtool` parser tests","Fix the filter in the parser YAML (typo, unknown function, wrong accessor)","Check that custom expression helpers used are registered in pkg/exprhelpers"],"exampleFix":"# before (invalid: 'contains' with wrong arity)\nfilter: evt.Parsed.msg contains\n# after\nfilter: evt.Parsed.msg contains 'failed'","handlingStrategy":"validation","validationCode":"_, err := expr.Compile(filter, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\nif err != nil { return fmt.Errorf(\"invalid filter %q: %w\", filter, err) }","typeGuard":"func filterCompiles(f string) bool {\n    _, err := expr.Compile(f, expr.AsBool())\n    return err == nil\n}","tryCatchPattern":"if err := node.compile(pctx, ectx); err != nil {\n    log.Errorf(\"parser node %s: %v\", node.Name, err)\n    return err\n}","preventionTips":["Test filter expressions with cscli hubtool test against sample events","Only use functions registered in pkg/exprhelpers","Quote strings with single quotes inside YAML to avoid escaping bugs","Pin expr-compatible CrowdSec versions when reusing hub expressions"],"tags":["parser","expr","compilation","filter"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}