crowdsecurity/crowdsec · error

compilation of '%s' failed: %w

Error message

compilation of '%s' failed: %w

What it means

ValidateContextExpr compiles each user-supplied alert-context expression with expr-lang to make sure it is syntactically and semantically valid before it is stored and later evaluated at alert time. If expr.Compile rejects the expression (syntax error, unknown identifier, wrong types for evt/match/req), it throws 'compilation of '%s' failed'. The wrapped error pinpoints the position and nature of the problem.

Source

Thrown at pkg/alertcontext/alertcontext.go:39

const MaxContextValueLen = 4000

var alertContext atomic.Pointer[Context]

type Context struct {
	ContextToSend         map[string][]string
	ContextValueLen       int
	ContextToSendCompiled map[string][]*vm.Program
}

func ValidateContextExpr(key string, expressions []string) error {
	for _, expression := range expressions {
		_, err := expr.Compile(expression, exprhelpers.GetExprOptions(map[string]any{
			"evt":   &pipeline.Event{},
			"match": &pipeline.MatchedRule{},
			"req":   &http.Request{},
		})...)
		if err != nil {
			return fmt.Errorf("compilation of '%s' failed: %w", expression, err)
		}
	}

	return nil
}

func NewAlertContext(contextToSend map[string][]string, valueLength int) error {
	if valueLength == 0 {
		log.Debugf("No console context value length provided, using default: %d", MaxContextValueLen)
		valueLength = MaxContextValueLen
	}

	if valueLength > MaxContextValueLen {
		log.Debugf("Provided console context value length (%d) is higher than the maximum, using default: %d", valueLength, MaxContextValueLen)
		valueLength = MaxContextValueLen
	}

	ac := Context{

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the expression per the wrapped expr error, which includes the exact position and reason
2. Validate field names against the event/alert structures (evt.Meta.*, match.*) and use expr's environment: evt is pipeline.Event, match is pipeline.MatchedRule, req is http.Request
3. Test expressions quickly with 'cscli explain' or a small Go test using TestValidateContextExpr patterns
4. Escape quotes correctly in YAML so the expression string isn't mangled before compilation

Example fix

# before
context:
  ip: evt.Meta.source_ip == # syntax error
# after
context:
  ip: evt.Meta.source_ip

if err := alertcontext.ValidateContextExpr(exprs); err != nil {
    return fmt.Errorf("invalid context expression: %w", err)
}

if err := alertcontext.ValidateContextExpr(userExprs); err != nil {
    var compErr *expr.Error
    if errors.As(err, &compErr) {
        log.Errorf("at %s: %v", compErr.FormattedPosition(), compErr.Message)
    }
    return err
}

When it happens

Trigger: addContext or TestValidateContextExpr passes an expression string that fails expr.Compile: unbalanced parentheses, using a field that doesn't exist on evt/match/req, calling a method that isn't registered in exprhelpers, or invalid operator usage like evt.Meta.source_ip > 'abc'.

Common situations: Operators write context rules in alert_context.yaml or console config; typo in a field path (evt.Meta.sourc_ip); attempting to use an unsupported builtin; forgetting quotes on a string literal.

Related errors

• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• headers is selected, but headers is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/22793de081daacdd. Report an issue: GitHub.