{"record":{"id":"94ec3d4cbfe0b2c1","repo":"crowdsecurity/crowdsec","slug":"error-compiling-filter-of-s-w","errorCode":null,"errorMessage":"error compiling filter of '%s': %w","messagePattern":"error compiling filter of '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csprofiles/csprofiles.go","lineNumber":58,"sourceCode":"\t\truntime.Logger = xlog.WithFields(log.Fields{\n\t\t\t\"type\": \"profile\",\n\t\t\t\"name\": profile.Name,\n\t\t})\n\n\t\truntime.RuntimeFilters = make([]*vm.Program, len(profile.Filters))\n\t\truntime.Cfg = profile\n\n\t\tif runtime.Cfg.OnSuccess != \"\" && runtime.Cfg.OnSuccess != \"continue\" && runtime.Cfg.OnSuccess != \"break\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid 'on_success' for '%s': %s\", profile.Name, runtime.Cfg.OnSuccess)\n\t\t}\n\n\t\tif runtime.Cfg.OnFailure != \"\" && runtime.Cfg.OnFailure != \"continue\" && runtime.Cfg.OnFailure != \"break\" && runtime.Cfg.OnFailure != \"apply\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid 'on_failure' for '%s' : %s\", profile.Name, runtime.Cfg.OnFailure)\n\t\t}\n\n\t\tfor fIdx, filter := range profile.Filters {\n\t\t\tif runtimeFilter, err = expr.Compile(filter, exprhelpers.GetExprOptions(map[string]interface{}{\"Alert\": &models.Alert{}})...); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error compiling filter of '%s': %w\", profile.Name, err)\n\t\t\t}\n\n\t\t\truntime.RuntimeFilters[fIdx] = runtimeFilter\n\t\t\tif profile.Debug != nil && *profile.Debug {\n\t\t\t\truntime.Logger.Logger.SetLevel(log.DebugLevel)\n\t\t\t}\n\t\t}\n\n\t\tif profile.DurationExpr != \"\" {\n\t\t\tif runtimeDurationExpr, err = expr.Compile(profile.DurationExpr, exprhelpers.GetExprOptions(map[string]interface{}{\"Alert\": &models.Alert{}})...); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error compiling duration_expr of %s: %w\", profile.Name, err)\n\t\t\t}\n\n\t\t\truntime.RuntimeDurationExpr = runtimeDurationExpr\n\t\t}\n\n\t\tfor _, decision := range profile.Decisions {\n\t\t\tif runtime.RuntimeDurationExpr == nil {","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csprofiles/csprofiles.go#L40-L76","documentation":"NewProfile compiles each profile filter expression with the expr library (with an Alert variable in scope); a syntactically or semantically invalid expression causes this wrapped error and aborts startup.","triggerScenarios":"Calling NewProfile with a profile whose Filters contain an expression that expr.Compile rejects: unknown variables/functions, syntax errors, type errors against models.Alert, or use of helpers absent from exprhelpers.GetExprOptions.","commonSituations":"Typos in field names (e.g. Alert.Source not Alert Sources); using functions not registered in exprhelpers; referencing event fields that don't exist on Alert; version changes removing a helper function; unbalanced parens or quotes in profiles.yaml.","solutions":["Read the wrapped underlying expr error to find the failing token/variable in the filter.","Test the filter expression with 'cscli explain' or a small expr playground using models.Alert as context.","Fix or remove the offending filter in profiles.yaml (or the hub profile file) — check function names against pkg/exprhelpers registered functions."],"exampleFix":"// before\nfilter: Alert.GetEvent() and Alert.GetScenario() in ['http-bf']\n// after\nfilter: Alert.GetScenario() in ['crowdsecurity/http-bf']","handlingStrategy":"validation","validationCode":"for _, f := range profile.Filters {\n\tif _, err := expr.Compile(f, exprhelpers.GetExprOptions(map[string]interface{}{\"Alert\": &models.Alert{}})...); err != nil {\n\t\treturn fmt.Errorf(\"bad profile filter %q: %w\", f, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if _, err := csprofiles.New(...); err != nil {\n\tvar werr error\n\tif errors.As(err, &werr) { /* inspect wrapped expr compile error */ }\n}","preventionTips":["Test filters with 'cscli explain' before deploying to production","Reference only fields on models.Alert and functions registered in exprhelpers","Validate hub profile files after upgrades that may change available expr helpers"],"tags":["profiles","expr","configuration"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}