crowdsecurity/crowdsec · error

applying %s: %w

Error message

applying %s: %w

What it means

Wraps an error from applying one of a node's compiled static entries at runtime while processing an event. The %s is the static entry's target expression, and %w is the underlying error from RuntimeStatic.Apply(). This happens per-event in the pipeline, so a single bad static rule will error on every matching event.

Source

Thrown at pkg/parser/runtime.go:216

		logger.Debugf(".Enriched[%s] = '%s'", rs.Config.Enriched, value)
		event.Enriched[rs.Config.Enriched] = value
	case rs.Config.TargetByName != "":
		if !SetTargetByName(rs.Config.TargetByName, value, event) {
			logger.Errorf("Unable to set value of '%s'", rs.Config.TargetByName)
		} else {
			logger.Debugf("%s = '%s'", rs.Config.TargetByName, value)
		}
	default:
		logger.Fatal("unable to process static : unknown target")
	}

	return nil
}

func (n *Node) ProcessStatics(event *pipeline.Event) error {
	for _, rs := range n.RuntimeStatics {
		if err := rs.Apply(event, n.EnrichFunctions, n.Logger, n.Debug); err != nil {
			return fmt.Errorf("applying %s: %w", rs.Config.targetExpr(), err)
		}
	}

	return nil
}

func (rg *RuntimeGrokPattern) ProcessStatics(event *pipeline.Event, ectx EnricherCtx, logger *log.Entry, debug bool) error {
	for _, rs := range rg.RuntimeStatics {
		if err := rs.Apply(event, ectx, logger, debug); err != nil {
			return fmt.Errorf("applying %s: %w", rs.Config.targetExpr(), err)
		}
	}

	return nil
}

func Parse(ctx UnixParserCtx, event pipeline.Event, nodes []Node, collector *StageParseCollector) (pipeline.Event, error) {
	/* the stage is undefined, probably line is freshly acquired, set to first stage !*/

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped error for the failing static's targetExpr
2. Validate the static rule with `cscli hubtool test` on a sample event
3. Fix the static's target/expression in the parser YAML
4. Add a filter to the node or static so the rule only runs when the required fields exist

Example fix

# before (static evaluated even when field missing)
statics:
  - target: evt.Parsed.target
    value: evt.Parsed.src + evt.Parsed.dst
# after (guard with a filter on the node)
filter: 'evt.Parsed.src != nil && evt.Parsed.dst != nil'
statics:
  - target: evt.Parsed.target
    expression: evt.Parsed.src + evt.Parsed.dst

if err := rs.Apply(&pipeline.Event{}, nil, logger, false); err != nil {
    log.Warnf("static %q fails on empty event: %v", rs.Config.targetExpr(), err)
}

if err := node.ProcessStatics(event); err != nil {
    log.Errorf("node %s: %v", node.Name, err)
    return err // or continue pipeline depending on policy
}

When it happens

Trigger: Calling Node.ProcessStatics(event) (from process) when a static rule's target/expression evaluation fails at runtime — e.g. the expr target expression evaluates to an invalid target, or Apply hits a type/evaluation error on the live event.

Common situations: Static rules with expressions that assume fields present only in some events, wrong target syntax (e.g. targeting evt.Parsed with a bad expression), enrichment function failures triggered from Apply.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• static %d: %w
• compiling static expression %q: %w
• no parser found. Please install the appropriate parser and r
• leaky failed :/
• grok requires 'expression' or 'apply_on'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/dd66d44c40e940c5. Report an issue: GitHub.