{"record":{"id":"b34debca10599dc4","repo":"crowdsecurity/crowdsec","slug":"while-running-scope-filter-w","errorCode":null,"errorMessage":"while running scope filter: %w","messagePattern":"while running scope filter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":175,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn srcs, fmt.Errorf(\"declared range %s of %s can't be parsed\", v, src.IP)\n\t\t\t}\n\n\t\t\tif ipNet != nil {\n\t\t\t\tsrc.Range = ipNet.String()\n\t\t\t\tleaky.logger.Tracef(\"Valid range from %s : %s\", src.IP, src.Range)\n\t\t\t}\n\t\t}\n\n\t\tif leaky.Factory.Spec.ScopeType.Scope == types.Ip {\n\t\t\tsrc.Value = &src.IP\n\t\t} else if leaky.Factory.Spec.ScopeType.Scope == types.Range {\n\t\t\tsrc.Value = &src.Range\n\n\t\t\tif leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {\n\t\t\t\tretValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{\"evt\": &evt}, leaky.logger, leaky.Factory.Spec.Debug)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn srcs, fmt.Errorf(\"while running scope filter: %w\", err)\n\t\t\t\t}\n\n\t\t\t\tvalue, ok := retValue.(string)\n\t\t\t\tif !ok {\n\t\t\t\t\tvalue = \"\"\n\t\t\t\t}\n\n\t\t\t\tsrc.Value = &value\n\t\t\t}\n\t\t}\n\n\t\tsrcs[*src.Value] = src\n\tdefault:\n\t\tif leaky.Factory.Spec.ScopeType.RunTimeFilter == nil {\n\t\t\treturn srcs, errors.New(\"empty scope information\")\n\t\t}\n\n\t\tretValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{\"evt\": &evt}, leaky.logger, leaky.Factory.Spec.Debug)","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L157-L193","documentation":"In crowdsec's leakybucket package, eventSources builds the source scope(s) of an event for a bucket whose ScopeType is types.Range. When a runtime scope filter expression is defined, it is evaluated via exprhelpers.Run against the event; if the expr-lang expression errors at evaluation time, the function aborts and wraps the underlying expression error in this message. It signals a scope filter from the parser/bucket config that failed at runtime, not a bucket-processing failure.","triggerScenarios":"A bucket profile/scenario with ScopeType Scope==Range has ScopeType.RunTimeFilter set, and exprhelpers.Run on {\"evt\": &evt} returns an error — e.g. the expression references a field absent from evt.Parsed, uses a wrong type (arithmetic on a string field), or calls an unknown expr function.","commonSituations":"Custom scenarios with a hand-written scope_filter like evt.Parsed.client_ip that doesn't exist for this parser output; a parser change removing/renaming a field the filter relies on; upgrading crowdsec and an expr built-in used in the filter changed behavior.","solutions":["Read the wrapped underlying expr error in the message to identify the failing expression element","Print the event (evt.Parsed/evt.Enriched) for a failing case and check every field the scope filter references exists and has the expected type","Fix the scope_filter expression in the scenario/profile YAML (or remove it to fall back to the static Scope)","Test the corrected expression with cscli / csctl hub or by replaying the offending log line through the parser"],"exampleFix":"// before (scenario yaml)\nscope:\n  type: range\n  filter: evt.Parsed.clientip\n// after\nscope:\n  type: range\n  filter: evt.Parsed.source_ip","handlingStrategy":"validation","validationCode":"// Before relying on the scenario, test the scope filter against representative parsed events:\n// crowdsec -type <type> -config ... with debug on the bucket, or replay the log line and\n// confirm evt.Parsed contains every field the filter references:\n// grep 'scope' /var/log/crowdsec.log after enabling debug: true on the scenario","typeGuard":"// In the expression, tolerate missing fields:\n// Get(evt.Parsed, 'client_ip', '') != ''","tryCatchPattern":null,"preventionTips":["Reference only fields guaranteed by the parser for the acquisition type","Use Get()/exists() in scope filters to handle optional fields","Test custom scenarios with cscli/csctl replay before deploying","Keep scope filters minimal; prefer static scope types when possible"],"tags":["crowdsec","expr","scope-filter","runtime"],"backgroundTag":"expr-filter-evaluation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}