{"record":{"id":"f7f00998e1f1f21c","repo":"crowdsecurity/crowdsec","slug":"failed-to-get-value-for-s-w","errorCode":null,"errorMessage":"failed to get value for %s: %w","messagePattern":"failed to get value for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/alertcontext/alertcontext.go","lineNumber":184,"sourceCode":"\t}\n\n\tif request == nil {\n\t\trequest = &http.Request{}\n\t}\n\n\tac := getAlertContext()\n\n\tfor key, values := range ac.ContextToSendCompiled {\n\t\tif _, ok := tmpContext[key]; !ok {\n\t\t\ttmpContext[key] = make([]string, 0)\n\t\t}\n\n\t\tfor _, value := range values {\n\t\t\tvar val string\n\n\t\t\toutput, err := expr.Run(value, map[string]any{\"match\": match, \"evt\": evt, \"req\": request})\n\t\t\tif err != nil {\n\t\t\t\terrors = append(errors, fmt.Errorf(\"failed to get value for %s: %w\", key, err))\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tswitch out := output.(type) {\n\t\t\tcase string:\n\t\t\t\tval = out\n\t\t\t\tif val != \"\" && !slices.Contains(tmpContext[key], val) {\n\t\t\t\t\ttmpContext[key] = append(tmpContext[key], val)\n\t\t\t\t}\n\t\t\tcase []string:\n\t\t\t\tfor _, v := range out {\n\t\t\t\t\tif v != \"\" && !slices.Contains(tmpContext[key], v) {\n\t\t\t\t\t\ttmpContext[key] = append(tmpContext[key], v)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tcase int:\n\t\t\t\tval = strconv.Itoa(out)\n\t\t\t\tif val != \"\" && !slices.Contains(tmpContext[key], val) {","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/alertcontext/alertcontext.go#L166-L202","documentation":"EvalAlertContextRules runs each compiled context expression with expr.Run against the live {match, evt, req} environment. If evaluation fails at runtime (nil pointer on a missing field, type error such as comparing string to int, calling a method on a nil evt/unmarshaled struct), the error is collected per key as 'failed to get value for %s: %w' and that key is omitted from the alert context while the rest continue to be evaluated.","triggerScenarios":"AppsecEventToContext/EventToContext invoke it per alert; expr.Run fails for a compiled value — e.g. evt.Meta.key is absent and the expression dereferences it unsafely, a type mismatch between operands, or a custom method in exprhelpers returning an error on this particular event shape.","commonSituations":"AppSec events where match/req fields differ from pipeline expectations; expressions written for parser events evaluated against appsec alerts; missing evt.Unmarshaled sections because the event was synthesized rather than parsed; wrong assumed types (e.g. int arithmetic on string meta values).","solutions":["Read the wrapped %w error for the failing key and make the expression nil/type-safe (use the 'in' operator, default values, or string coercion)","Guard optional fields: e.g. use 'evt.Meta.source_ip in [\"1.2.3.4\"]' style checks instead of direct arithmetic on possibly absent values","Test the expression against both pipeline and appsec event shapes with cscli explain or unit tests","Check that the exprhelpers builtin used exists and handles the runtime type (string vs int) for this event"],"exampleFix":"# before (fails when evt.Unmarshaled is empty)\ncontext:\n  ua: evt.Unmarshaled.appsec.http_user_agent\n# after\ncontext:\n  ua: len(evt.Unmarshaled.appsec) > 0 ? evt.Unmarshaled.appsec.http_user_agent : \"\"","handlingStrategy":"try-catch","validationCode":"// pre-check compiled exprs against sample data\ntestEnv := map[string]any{\"match\": &pipeline.MatchedRule{}, \"evt\": &pipeline.Event{}, \"req\": &http.Request{}}\nfor _, v := range ac.ContextToSendCompiled {\n    if _, err := expr.Run(v[0], testEnv); err != nil { log.Warnf(\"expr fails on empty evt\") }\n}","typeGuard":null,"tryCatchPattern":"ctx, errs := ac.EvalAlertContextRules(evt, match, req)\nif len(errs) > 0 {\n    for _, e := range errs { log.Warnf(\"context key omitted: %v\", e) }\n    // continue: alert is still sent with the keys that evaluated\n}","preventionTips":["Write expressions that tolerate missing fields (use 'in', len() checks, ternaries)","Test expressions against both pipeline and appsec event shapes","Avoid int arithmetic on string meta values; cast explicitly","Alert on recurring EvalAlertContextRules errors per key — they silently drop metadata"],"tags":["expr","runtime","context"],"backgroundTag":"unexpected-response-shape","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}