crowdsecurity/crowdsec · error

compilation of '%s' context value failed: %w

Error message

compilation of '%s' context value failed: %w

What it means

NewAlertContext builds the AlertContext object from configured context keys, and compiles each individual context value expression at startup so failures surface early rather than at alert time. If expr.Compile rejects one of the value expressions it throws 'compilation of '%s' context value failed', naming the offending value string and wrapping the expr error.

Source

Thrown at pkg/alertcontext/alertcontext.go:79

	}

	for key, values := range contextToSend {
		if _, ok := ac.ContextToSend[key]; !ok {
			ac.ContextToSend[key] = make([]string, 0)
		}

		if _, ok := ac.ContextToSendCompiled[key]; !ok {
			ac.ContextToSendCompiled[key] = make([]*vm.Program, 0)
		}

		for _, value := range values {
			valueCompiled, err := expr.Compile(value, exprhelpers.GetExprOptions(map[string]any{
				"evt":   &pipeline.Event{},
				"match": &pipeline.MatchedRule{},
				"req":   &http.Request{},
			})...)
			if err != nil {
				return fmt.Errorf("compilation of '%s' context value failed: %w", value, err)
			}

			ac.ContextToSendCompiled[key] = append(ac.ContextToSendCompiled[key], valueCompiled)
			ac.ContextToSend[key] = append(ac.ContextToSend[key], value)
		}
	}

	alertContext.Store(&ac)

	return nil
}

func getAlertContext() *Context {
	if ac := alertContext.Load(); ac != nil {
		return ac
	}

	return &Context{}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the value expression using the wrapped expr error's position/message
2. Only reference the provided variables: evt (*pipeline.Event), match (*pipeline.MatchedRule), req (*http.Request), and exprhelpers-builtins like evt.Unmarshaled, LogType etc.
3. Restart crowdsec — config is validated at load time, so after the fix startup will proceed
4. Check YAML quoting: wrap expressions in single quotes if they contain colons or braces

Example fix

# before
context_to_send:
  source_ip: 'evt.Meta.source_ip &&'
# after
context_to_send:
  source_ip: 'evt.Meta.source_ip'

for _, v := range contextValues {
    if err := alertcontext.ValidateContextExpr([]string{v}); err != nil {
        return fmt.Errorf("context value %q: %w", v, err)
    }
}

ac, err := alertcontext.NewAlertContext(cfg)
if err != nil {
    if strings.Contains(err.Error(), "context value failed") {
        return fmt.Errorf("fix alert_context config: %w", err)
    }
    return err
}

When it happens

Trigger: Called at startup from LoadBuckets (or in tests): a context entry in configuration (e.g. alert_context mapping) has a value expression with a syntax error, an unknown identifier not in {evt, match, req}, or a type-incompatible operation, so expr.Compile returns an error.

Common situations: User edits context_to_send / alert_context config and introduces a typo (evt.Meta.ip vs evt.Meta.source_ip); quotes lost through YAML parsing; using a function not exported by exprhelpers in the expression environment.

Related errors

• no configuration paths provided
• cti is disabled
• compilation of '%s' failed: %w
• while parsing '%s': %w
• failed to compile profiles: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c9667176b74bc7c1. Report an issue: GitHub.