{"record":{"id":"8576284c3b1b8c16","repo":"crowdsecurity/crowdsec","slug":"while-compiling-stash-value-expression-w","errorCode":null,"errorMessage":"while compiling stash value expression: %w","messagePattern":"while compiling stash value expression: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/stash.go","lineNumber":70,"sourceCode":"\t}\n\n\t// should be configurable\n\tif s.MaxMapSize == 0 {\n\t\ts.MaxMapSize = 100\n\t}\n\n\treturn nil\n}\n\nfunc (s *Stash) Compile(logger *log.Entry) (*RuntimeStash, error) {\n\tvar err error\n\n\trs := &RuntimeStash{Config: s}\n\n\trs.ValueExpression, err = expr.Compile(s.Value,\n\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while compiling stash value expression: %w\", err)\n\t}\n\n\trs.KeyExpression, err = expr.Compile(s.Key,\n\t\texprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while compiling stash key expression: %w\", err)\n\t}\n\n\trs.TTLVal, err = time.ParseDuration(s.TTL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while parsing stash ttl: %w\", err)\n\t}\n\n\t// init the cache, does it make sense to create it here just to be sure everything is fine ?\n\n\tcacheCfg := cache.CacheCfg{\n\t\tSize:     s.MaxMapSize,\n\t\tTTL:      rs.TTLVal,","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/stash.go#L52-L88","documentation":"Stash.Compile() compiles the `value` expression with the expr library against a pipeline.Event environment. If the expression is syntactically invalid or references unknown fields/functions, compilation fails and the error is wrapped so the stash cannot be instantiated.","triggerScenarios":"Calling Compile on a validated Stash whose `Value` string is not a valid expr program (syntax error, unknown identifier, wrong types) — happens during parser startup when loading stash configs.","commonSituations":"Typos in expr syntax (`evt.Parsed.src-ip`), referencing fields that don't exist on evt, using a helper function not registered in exprhelpers.","solutions":["Read the underlying expr error after 'while compiling stash value expression:' to locate the syntax/identifier problem.","Test the expression with `cscli hubtool` / expr debugging against a real event to confirm fields exist.","Fix the value expression in the stash config and reload."],"exampleFix":"// before\nvalue: evt.Parsed.src-address\n// after\nvalue: evt.Parsed.source_ip","handlingStrategy":"try-catch","validationCode":"if _, err := expr.Compile(s.Value, exprhelpers.GetExprOptions(map[string]any{\"evt\": &pipeline.Event{}})...); err != nil {\n    return fmt.Errorf(\"stash %q value expr invalid: %w\", s.Name, err)\n}","typeGuard":null,"tryCatchPattern":"rs, err := stash.Compile()\nif err != nil {\n    if strings.Contains(err.Error(), \"stash value expression\") { /* fix value: expr */ }\n    return err\n}","preventionTips":["Test value expressions against a dumped real event before shipping configs.","Keep expressions simple; verify evt field names against the parser output."],"tags":["parser","stash","expr","compilation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}