{"record":{"id":"c9667176b74bc7c1","repo":"crowdsecurity/crowdsec","slug":"compilation-of-s-context-value-failed-w","errorCode":null,"errorMessage":"compilation of '%s' context value failed: %w","messagePattern":"compilation of '(.+?)' context value failed: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/alertcontext/alertcontext.go","lineNumber":79,"sourceCode":"\t}\n\n\tfor key, values := range contextToSend {\n\t\tif _, ok := ac.ContextToSend[key]; !ok {\n\t\t\tac.ContextToSend[key] = make([]string, 0)\n\t\t}\n\n\t\tif _, ok := ac.ContextToSendCompiled[key]; !ok {\n\t\t\tac.ContextToSendCompiled[key] = make([]*vm.Program, 0)\n\t\t}\n\n\t\tfor _, value := range values {\n\t\t\tvalueCompiled, err := expr.Compile(value, exprhelpers.GetExprOptions(map[string]any{\n\t\t\t\t\"evt\":   &pipeline.Event{},\n\t\t\t\t\"match\": &pipeline.MatchedRule{},\n\t\t\t\t\"req\":   &http.Request{},\n\t\t\t})...)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"compilation of '%s' context value failed: %w\", value, err)\n\t\t\t}\n\n\t\t\tac.ContextToSendCompiled[key] = append(ac.ContextToSendCompiled[key], valueCompiled)\n\t\t\tac.ContextToSend[key] = append(ac.ContextToSend[key], value)\n\t\t}\n\t}\n\n\talertContext.Store(&ac)\n\n\treturn nil\n}\n\nfunc getAlertContext() *Context {\n\tif ac := alertContext.Load(); ac != nil {\n\t\treturn ac\n\t}\n\n\treturn &Context{}","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/alertcontext/alertcontext.go#L61-L97","documentation":"NewAlertContext builds the AlertContext object from configured context keys, and compiles each individual context value expression at startup so failures surface early rather than at alert time. If expr.Compile rejects one of the value expressions it throws 'compilation of '%s' context value failed', naming the offending value string and wrapping the expr error.","triggerScenarios":"Called at startup from LoadBuckets (or in tests): a context entry in configuration (e.g. alert_context mapping) has a value expression with a syntax error, an unknown identifier not in {evt, match, req}, or a type-incompatible operation, so expr.Compile returns an error.","commonSituations":"User edits context_to_send / alert_context config and introduces a typo (evt.Meta.ip vs evt.Meta.source_ip); quotes lost through YAML parsing; using a function not exported by exprhelpers in the expression environment.","solutions":["Fix the value expression using the wrapped expr error's position/message","Only reference the provided variables: evt (*pipeline.Event), match (*pipeline.MatchedRule), req (*http.Request), and exprhelpers-builtins like evt.Unmarshaled, LogType etc.","Restart crowdsec — config is validated at load time, so after the fix startup will proceed","Check YAML quoting: wrap expressions in single quotes if they contain colons or braces"],"exampleFix":"# before\ncontext_to_send:\n  source_ip: 'evt.Meta.source_ip &&'\n# after\ncontext_to_send:\n  source_ip: 'evt.Meta.source_ip'","handlingStrategy":"validation","validationCode":"for _, v := range contextValues {\n    if err := alertcontext.ValidateContextExpr([]string{v}); err != nil {\n        return fmt.Errorf(\"context value %q: %w\", v, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"ac, err := alertcontext.NewAlertContext(cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"context value failed\") {\n        return fmt.Errorf(\"fix alert_context config: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate config at CI time with crowdsec -t before rollout","Start expressions simple and build up incrementally","Use field autocompletion from pipeline.Event / pipeline.MatchedRule definitions","Single-quote YAML values containing colons, braces or '&&'"],"tags":["expr","config","startup"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}