{"record":{"id":"dc42a4cfd46bd4a3","repo":"crowdsecurity/crowdsec","slug":"leaky-failed","errorCode":null,"errorMessage":"leaky failed :/","messagePattern":"leaky failed :/","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/manager_run.go","lineNumber":250,"sourceCode":"\t\t\t}\n\t\t\t// we assume we a bool should add type check here\n\t\t\tif condition, ok = output.(bool); !ok {\n\t\t\t\tholders[idx].logger.Errorf(\"unexpected non-bool return : %T\", output)\n\t\t\t\tholders[idx].logger.Fatalf(\"Filter issue\")\n\t\t\t}\n\t\t\tif !condition {\n\t\t\t\tholders[idx].logger.Debugf(\"Event leaving node : ko (filter mismatch)\")\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\t// groupby determines the partition key for the specific bucket\n\t\tvar groupby string\n\t\tif holders[idx].RunTimeGroupBy != nil {\n\t\t\ttmpGroupBy, err := exprhelpers.Run(holders[idx].RunTimeGroupBy, map[string]any{\"evt\": &parsed}, holders[idx].logger, holders[idx].Spec.Debug)\n\t\t\tif err != nil {\n\t\t\t\tholders[idx].logger.Errorf(\"failed groupby : %v\", err)\n\t\t\t\treturn false, errors.New(\"leaky failed :/\")\n\t\t\t}\n\n\t\t\tif groupby, ok = tmpGroupBy.(string); !ok {\n\t\t\t\tholders[idx].logger.Fatalf(\"failed groupby type : %v\", err)\n\t\t\t\treturn false, errors.New(\"groupby wrong type\")\n\t\t\t}\n\t\t}\n\t\tbuckey := holders[idx].BucketKey(groupby)\n\n\t\t// we need to either find the existing bucket, or create a new one (if it's the first event to hit it for this partition key)\n\t\tbucket, err := LoadOrStoreBucketFromHolder(ctx, buckey, buckets, &holders[idx], parsed.ExpectMode)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"failed to load or store bucket: %w\", err)\n\t\t}\n\t\t// finally, pour the even into the bucket\n\n\t\tif bucket.Factory.orderEvent {\n\t\t\tif orderEvent == nil {","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/manager_run.go#L232-L268","documentation":"PourItemToHolders evaluates the bucket's groupby expression via exprhelpers.Run to partition buckets by key; if the expression itself errors (compile/runtime failure), pouring is aborted and this opaque error is returned.","triggerScenarios":"An event is poured into a bucket whose RunTimeGroupBy expression fails to evaluate (bad syntax at compile, nil field access, or wrong data types at runtime).","commonSituations":"Groupby referencing a nonexistent event field (e.g. evt.Meta.target_user on events lacking it), or a malformed expr expression in the scenario's `groupby:` directive.","solutions":["Fix the `groupby:` expression in the scenario so it compiles and never errors on the event shapes you feed (guard with coalescing, e.g. `evt.Meta.source_ip` fields that always exist)","Check crowdsec logs for the preceding 'failed groupby' line to see the real underlying expr error","Test the scenario with `cscli hubtest` before deploying"],"exampleFix":"# before\ngroupby: \"evt.Meta.nonexistent_field\"\n# after\ngroupby: \"evt.Meta.source_ip\"","handlingStrategy":"validation","validationCode":"// ensure groupby only references fields present on all event shapes\nok, err := exprhelpers.Compile(\"evt.Meta.source_ip\", nil)\nif err != nil || !ok { return err }","typeGuard":null,"tryCatchPattern":"if _, pourErr := PourItemToHolders(ctx, parsed, holders, buckets); pourErr != nil {\n    log.Printf(\"pour failed: %v; check scenario groupby/filter expressions\", pourErr)\n    return pourErr\n}","preventionTips":["Only groupby fields guaranteed on every event (source_ip, etc.)","Read the 'failed groupby' log line above this error for the real expr error","Validate scenarios with hubtest and representative logs"],"tags":["crowdsec","leakybucket","expr","runtime"],"backgroundTag":"internal-invariant-violation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}