{"record":{"id":"8680686caea70ec3","repo":"crowdsecurity/crowdsec","slug":"error-compiling-the-scope-filter-w","errorCode":null,"errorMessage":"error compiling the scope filter: %w","messagePattern":"error compiling the scope filter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/scopetype.go","lineNumber":41,"sourceCode":"\tif s.Scope == types.Ip {\n\t\tif s.Filter != \"\" {\n\t\t\treturn errors.New(\"filter is not allowed for IP scope\")\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif s.Scope == types.Range && s.Filter == \"\" {\n\t\treturn nil\n\t}\n\n\tif s.Filter == \"\" {\n\t\treturn errors.New(\"filter is mandatory for non-IP, non-Range scope\")\n\t}\n\n\trunTimeFilter, err := compile(s.Filter, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error compiling the scope filter: %w\", err)\n\t}\n\n\ts.RunTimeFilter = runTimeFilter\n\n\treturn nil\n}\n","sourceCodeStart":23,"sourceCodeEnd":48,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/scopetype.go#L23-L48","documentation":"ScopeType.CompileFilter validates and compiles the scope filter expression for non-IP, non-Range scopes. A filter is mandatory there, and compile() (expr compilation, not evaluation) turns the expression into a runnable form. If the expression has syntax errors or references unknown functions/variables, compilation fails and this error wraps the compile error. It happens at hub-item load time, before any event is processed.","triggerScenarios":"Loading a scenario/profile whose scope type requires a filter (filter empty → 'filter is mandatory' wrapped as the compile error, or a syntactically invalid expression / unknown expr function passed to compile(s.Filter, nil)).","commonSituations":"Typo in scope_filter YAML; unbalanced parentheses; using a function not registered in exprhelpers; YAML indentation merging the filter with another key; broken hub item after manual edit.","solutions":["Read the wrapped compile error for the exact syntax problem and character offset","Validate the expression syntax (balanced parens, correct field paths like evt.Parsed.x)","Only use functions available in crowdsec's expr environment (see exprhelpers)","Reload the hub after fixing; the bucket will fail to compile until then"],"exampleFix":"// before\nscope:\n  type: custom\n  filter: evt.Parsed.user &&\n// after\nscope:\n  type: custom\n  filter: evt.Parsed.user != ''","handlingStrategy":"validation","validationCode":"// Compile-check the expression at load time in your own tooling:\n_, err := expr.Compile(scopeFilter, expr.Env(map[string]any{\"evt\": &models.Event{}}))\nif err != nil { return fmt.Errorf(\"scope filter invalid: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := scopeType.CompileFilter(); err != nil {\n    log.Errorf(\"rejecting hub item, bad scope filter: %v\", err)\n    return err\n}","preventionTips":["Lint custom scenarios before cscli hub reload","Use only expr functions registered in exprhelpers","Check YAML indentation so filter strings aren't mangled","Keep a replay test per custom scenario"],"tags":["crowdsec","expr","compilation","scope-filter"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}