{"record":{"id":"6c5fcaca35a65883","repo":"crowdsecurity/crowdsec","slug":"while-compiling-stash-key-expression-w","errorCode":null,"errorMessage":"while compiling stash key expression: %w","messagePattern":"while compiling stash key expression: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/stash.go","lineNumber":76,"sourceCode":"\n\treturn nil\n}\n\nfunc (s *Stash) Compile(logger *log.Entry) (*RuntimeStash, error) {\n\tvar err error\n\n\trs := &RuntimeStash{Config: s}\n\n\trs.ValueExpression, err = expr.Compile(s.Value,\n\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while compiling stash value expression: %w\", err)\n\t}\n\n\trs.KeyExpression, err = expr.Compile(s.Key,\n\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while compiling stash key expression: %w\", err)\n\t}\n\n\trs.TTLVal, err = time.ParseDuration(s.TTL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while parsing stash ttl: %w\", err)\n\t}\n\n\t// init the cache, does it make sense to create it here just to be sure everything is fine ?\n\n\tcacheCfg := cache.CacheCfg{\n\t\tSize:     s.MaxMapSize,\n\t\tTTL:      rs.TTLVal,\n\t\tName:     s.Name,\n\t\tStrategy: s.Strategy,\n\t\tLogLevel: logger.Logger.GetLevel(),\n\t}\n\n\tif err = cache.CacheInit(cacheCfg, cacheCfg.NewLogger()); err != nil {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/stash.go#L58-L94","documentation":"Compiling the stash entry's Key expr expression failed. The stash (parser key/value store) requires both Key and Value to be valid expr code evaluated against an evt of type pipeline.Event; a syntax error or unknown identifier in the key expression lands here.","triggerScenarios":"Compile is called with a Stash whose `Key` string fails expr compilation — syntax error, unknown function, or type mismatch against pipeline.Event.","commonSituations":"Key expressions using fields absent from the event at stash time, or quoting mistakes in YAML that mangle the expression.","solutions":["Fix the stash key expression in the parser configuration — check expr syntax and available evt fields","If referencing helper functions, verify they exist (exprhelpers) in the installed version"],"exampleFix":"// before\nkey: evt.Parsed.ip +\n// after\nkey: evt.Parsed.source_ip","handlingStrategy":"validation","validationCode":"if _, err := expr.Compile(s.Key, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...); err != nil {\n    return fmt.Errorf(\"stash %q key expr invalid: %w\", s.Name, err)\n}","typeGuard":null,"tryCatchPattern":"rs, err := stash.Compile()\nif err != nil {\n    if strings.Contains(err.Error(), \"stash key expression\") { /* fix key: expr */ }\n    return err\n}","preventionTips":["Prefer simple field references as keys (e.g. evt.Parsed.source_ip).","Validate YAML quoting — long expressions on one line, not folded blocks."],"tags":["parser","stash","expr","compilation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}