{"record":{"id":"dc4962e094348df1","repo":"crowdsecurity/crowdsec","slug":"grok-requires-expression-or-apply-on","errorCode":null,"errorMessage":"grok requires 'expression' or 'apply_on'","messagePattern":"grok requires 'expression' or 'apply_on'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/grok.go","lineNumber":90,"sourceCode":"\t}\n\n\t/* load grok statics */\n\t// compile expr statics if present\n\tfor _, static := range g.Statics {\n\t\tcompiled, err := static.Compile()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\trg.RuntimeStatics = append(rg.RuntimeStatics, *compiled)\n\t}\n\n\treturn rg, nil\n}\n\nfunc (g *GrokPattern) Validate() error {\n\tif g.TargetField == \"\" && g.ExpValue == \"\" {\n\t\treturn errors.New(\"grok requires 'expression' or 'apply_on'\")\n\t}\n\n\tif g.RegexpName == \"\" && g.RegexpValue == \"\" {\n\t\treturn errors.New(\"grok needs 'pattern' or 'name'\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":72,"sourceCodeEnd":99,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/grok.go#L72-L99","documentation":"GrokPattern.Validate() requires that a grok node actually targets something: at least one of TargetField (apply_on) or ExpValue (expression) must be non-empty, otherwise the pattern has no input to match against and would be meaningless at parse time.","triggerScenarios":"Calling GrokPattern.Validate() on a parser node where both 'apply_on' (target field) and 'expression' (ExpValue) are empty/missing strings, e.g. a grok stanza in a parser YAML defining only the pattern/name.","commonSituations":"Hand-written parser YAML with a grok section missing the apply_on key, an expression key typo'd (e.g. 'expr'), or programmatically built GrokPattern structs with unset fields.","solutions":["Add apply_on to the grok node naming the field to match (e.g. evt.Raw or evt.Meta.field).","Or add an expression whose result supplies the value to apply the grok on.","Fix key typos so the YAML unmarshals into TargetField/ExpValue."],"exampleFix":"// before\ngrok:\n  name: SYSLOGLINE\n// after\ngrok:\n  name: SYSLOGLINE\n  apply_on: message","handlingStrategy":"validation","validationCode":"if grok.TargetField == \"\" && grok.ExpValue == \"\" {\n    return errors.New(\"grok stanza needs 'apply_on' or 'expression'\")\n}","typeGuard":null,"tryCatchPattern":"if err := grokPattern.Validate(); err != nil {\n    return fmt.Errorf(\"parser node %s invalid: %w\", nodeName, err)\n}","preventionTips":["Always set apply_on in grok parser stanzas","Validate parser YAML with 'cscli hubtool' or a schema check before loading","Beware key typos ('expr', 'target') that silently leave fields empty"],"tags":["parser","grok","validation","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}