cilium/cilium · error

invalid http path filter: %w

Error message

invalid http path filter: %w

What it means

This error wraps a failure from filterByHTTPPaths when building a filter for FlowFilter.httpPath. It indicates the supplied HTTP path patterns could not be compiled, usually due to an invalid regular expression used as a path pattern. The underlying regex/parse error is chained with %w.

Source

Thrown at pkg/hubble/filters/http.go:191

	if ff.GetHttpMethod() != nil {
		if !httpMatchCompatibleEventFilter(ff.GetEventType()) {
			return nil, errors.New("filtering by http method requires " +
				"the event type filter to only match 'l7' events")
		}

		fs = append(fs, filterByHTTPMethods(ff.GetHttpMethod()))
	}

	if ff.GetHttpPath() != nil {
		if !httpMatchCompatibleEventFilter(ff.GetEventType()) {
			return nil, errors.New("filtering by http path requires " +
				"the event type filter to only match 'l7' events")
		}

		pathf, err := filterByHTTPPaths(ff.GetHttpPath())
		if err != nil {
			return nil, fmt.Errorf("invalid http path filter: %w", err)
		}
		fs = append(fs, pathf)
	}

	if ff.GetHttpUrl() != nil {
		if !httpMatchCompatibleEventFilter(ff.GetEventType()) {
			return nil, errors.New("filtering by http url requires " +
				"the event type filter to only match 'l7' events")
		}

		pathf, err := filterByHTTPUrls(ff.GetHttpUrl())
		if err != nil {
			return nil, fmt.Errorf("invalid http url filter: %w", err)
		}
		fs = append(fs, pathf)
	}

	if ff.GetHttpHeader() != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped error to identify which path pattern is invalid and fix the regex (escape special characters, close groups/brackets).
2. Test each path pattern with Go's regexp.Compile before adding it to the filter.
3. Use literal paths without regex metacharacters when exact matching is intended.

Example fix

// before
flowFilter.HttpPath = []string{"/api/(v1"}
// after
flowFilter.HttpPath = []string{"/api/v1/.*"}

for _, p := range flowFilter.GetHttpPath() {
    if _, err := regexp.Compile(p); err != nil {
        return fmt.Errorf("http path pattern %q is not a valid regex: %w", p, err)
    }
}

func isCompileableRegex(s string) bool {
    _, err := regexp.Compile(s)
    return err == nil
}

ffs, err := filterBuilder.Build(ctx, flowFilter)
if err != nil && strings.Contains(err.Error(), "invalid http path filter") {
    return fmt.Errorf("check httpPath regex patterns: %w", err)
}

When it happens

Trigger: OnBuildFilter called with FlowFilter.httpPath entries that are invalid regexes, e.g. '[/api/' or a pattern with an unmatched parenthesis.

Common situations: Users writing regex-style HTTP path filters with unbalanced brackets or quantifiers, or pasting shell glob patterns expecting regex semantics.

Related errors

• invalid http url filter: %w
• filtering by http status code requires the event type filter
• filtering by http method requires the event type filter to o
• filtering by http path requires the event type filter to onl
• filtering by http url requires the event type filter to only

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/d95ed0f436a98af4. Report an issue: GitHub.