{"record":{"id":"dd66d44c40e940c5","repo":"crowdsecurity/crowdsec","slug":"applying-s-w","errorCode":null,"errorMessage":"applying %s: %w","messagePattern":"applying (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/runtime.go","lineNumber":216,"sourceCode":"\t\tlogger.Debugf(\".Enriched[%s] = '%s'\", rs.Config.Enriched, value)\n\t\tevent.Enriched[rs.Config.Enriched] = value\n\tcase rs.Config.TargetByName != \"\":\n\t\tif !SetTargetByName(rs.Config.TargetByName, value, event) {\n\t\t\tlogger.Errorf(\"Unable to set value of '%s'\", rs.Config.TargetByName)\n\t\t} else {\n\t\t\tlogger.Debugf(\"%s = '%s'\", rs.Config.TargetByName, value)\n\t\t}\n\tdefault:\n\t\tlogger.Fatal(\"unable to process static : unknown target\")\n\t}\n\n\treturn nil\n}\n\nfunc (n *Node) ProcessStatics(event *pipeline.Event) error {\n\tfor _, rs := range n.RuntimeStatics {\n\t\tif err := rs.Apply(event, n.EnrichFunctions, n.Logger, n.Debug); err != nil {\n\t\t\treturn fmt.Errorf(\"applying %s: %w\", rs.Config.targetExpr(), err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (rg *RuntimeGrokPattern) ProcessStatics(event *pipeline.Event, ectx EnricherCtx, logger *log.Entry, debug bool) error {\n\tfor _, rs := range rg.RuntimeStatics {\n\t\tif err := rs.Apply(event, ectx, logger, debug); err != nil {\n\t\t\treturn fmt.Errorf(\"applying %s: %w\", rs.Config.targetExpr(), err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc Parse(ctx UnixParserCtx, event pipeline.Event, nodes []Node, collector *StageParseCollector) (pipeline.Event, error) {\n\t/* the stage is undefined, probably line is freshly acquired, set to first stage !*/","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/runtime.go#L198-L234","documentation":"Wraps an error from applying one of a node's compiled static entries at runtime while processing an event. The %s is the static entry's target expression, and %w is the underlying error from RuntimeStatic.Apply(). This happens per-event in the pipeline, so a single bad static rule will error on every matching event.","triggerScenarios":"Calling Node.ProcessStatics(event) (from process) when a static rule's target/expression evaluation fails at runtime — e.g. the expr target expression evaluates to an invalid target, or Apply hits a type/evaluation error on the live event.","commonSituations":"Static rules with expressions that assume fields present only in some events, wrong target syntax (e.g. targeting evt.Parsed with a bad expression), enrichment function failures triggered from Apply.","solutions":["Check the wrapped error for the failing static's targetExpr","Validate the static rule with `cscli hubtool test` on a sample event","Fix the static's target/expression in the parser YAML","Add a filter to the node or static so the rule only runs when the required fields exist"],"exampleFix":"# before (static evaluated even when field missing)\nstatics:\n  - target: evt.Parsed.target\n    value: evt.Parsed.src + evt.Parsed.dst\n# after (guard with a filter on the node)\nfilter: 'evt.Parsed.src != nil && evt.Parsed.dst != nil'\nstatics:\n  - target: evt.Parsed.target\n    expression: evt.Parsed.src + evt.Parsed.dst","handlingStrategy":"try-catch","validationCode":"if err := rs.Apply(&pipeline.Event{}, nil, logger, false); err != nil {\n    log.Warnf(\"static %q fails on empty event: %v\", rs.Config.targetExpr(), err)\n}","typeGuard":null,"tryCatchPattern":"if err := node.ProcessStatics(event); err != nil {\n    log.Errorf(\"node %s: %v\", node.Name, err)\n    return err // or continue pipeline depending on policy\n}","preventionTips":["Add node filters so statics only run when required fields exist","Use expression forms that tolerate missing parsed fields","Rehearse statics against representative sample logs before deploy"],"tags":["parser","runtime","statics","pipeline"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}