crowdsecurity/crowdsec · error

compilation of %q failed: %v

Error message

compilation of %q failed: %v

What it means

Wraps an Expr (expr-lang) compilation failure for a parser node's filter expression during node compilation. The %q is the raw filter string, and %v is the compiler's syntax/semantic error. Thrown because CrowdSec parses filters into executable expressions at node-compile time and cannot proceed with an uncompilable filter.

Source

Thrown at pkg/parser/node.go:436

	} else {
		/* else bind it to the default one (might find something more elegant here)*/
		clog = log.WithField("module", "parser")
	}

	n.Logger = clog.WithField("id", n.rn)

	/* display info about top-level nodes, they should be the only one with explicit stage name ?*/
	n.Logger = n.Logger.WithFields(log.Fields{"stage": n.Stage, "name": n.Name})

	if n.Logger.Logger.IsLevelEnabled(log.TraceLevel) {
		n.Logger.Tracef("Compiling: %s", dumpr.Sdump(n))
	}

	// compile filter if present
	if n.Filter != "" {
		n.RunTimeFilter, err = expr.Compile(n.Filter, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
		if err != nil {
			return fmt.Errorf("compilation of %q failed: %v", n.Filter, err)
		}
	}

	/* handle pattern_syntax and groks */
	for _, pattern := range n.SubGroks {
		n.Logger.Tracef("Adding subpattern '%s': '%s'", pattern.Key, pattern.Value)

		if err = pctx.Grok.Add(pattern.Key.(string), pattern.Value.(string)); err != nil {
			if errors.Is(err, grokky.ErrAlreadyExist) {
				n.Logger.Warningf("grok '%s' already registred", pattern.Key)
				continue
			}

			n.Logger.Errorf("Unable to compile subpattern %s: %v", pattern.Key, err)

			return err
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %v from expr.Compile for the exact syntax error and line position
2. Validate the expression independently with expr-lang syntax checks or `cscli hubtool` parser tests
3. Fix the filter in the parser YAML (typo, unknown function, wrong accessor)
4. Check that custom expression helpers used are registered in pkg/exprhelpers

Example fix

# before (invalid: 'contains' with wrong arity)
filter: evt.Parsed.msg contains
# after
filter: evt.Parsed.msg contains 'failed'

_, err := expr.Compile(filter, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
if err != nil { return fmt.Errorf("invalid filter %q: %w", filter, err) }

func filterCompiles(f string) bool {
    _, err := expr.Compile(f, expr.AsBool())
    return err == nil
}

if err := node.compile(pctx, ectx); err != nil {
    log.Errorf("parser node %s: %v", node.Name, err)
    return err
}

When it happens

Trigger: Calling node.compile() (from processStageFile or TestParserConfigs) when node.Filter contains invalid expr-lang syntax, references unknown functions, or uses wrong types (e.g. evt.Parsed on a missing field helper).

Common situations: Typos in filter expressions, using functions not registered via exprhelpers, quoting mistakes in YAML, expressions valid in a newer/older expr version than the one shipped.

Related errors

• stash %s: %w
• while compiling stash value expression: %w
• while compiling stash key expression: %w
• compiling static expression %q: %w
• unable to compile filter %s : %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5893705fe035e8ed. Report an issue: GitHub.