crowdsecurity/crowdsec · error

compiling static expression %q: %w

Error message

compiling static expression %q: %w

What it means

Static.Compile() compiles the optional `expression` of a statics entry into an expr program evaluated at runtime to produce the static value. If the expression fails to compile the whole statics config is rejected, with the offending expression quoted.

Source

Thrown at pkg/parser/static.go:62

	if s.Meta == "" && s.Parsed == "" && s.TargetByName == "" {
		return errors.New("at least one of meta/event/target must be set")
	}

	if s.Value == "" && s.ExpValue == "" {
		return errors.New("value or expression must be set")
	}

	return nil
}

func (s *Static) Compile() (*RuntimeStatic, error) {
	cs := &RuntimeStatic{Config: s}

	if s.ExpValue != "" {
		prog, err := expr.Compile(s.ExpValue,
			exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
		if err != nil {
			return nil, fmt.Errorf("compiling static expression %q: %w", s.ExpValue, err)
		}

		cs.RunTimeValue = prog
	}

	return cs, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Look at the expr error under the quoted expression to find the exact syntax problem.
2. Validate the expression against a real event (debug mode / cscli hubtool) to confirm fields exist.
3. Fix the `expression:` line and reload; if you want a literal value, use `value:` instead of `expression:`.

Example fix

// before
statics:
  - meta: service
    expression: evt.Parsed.service == 'ssh' ? 'sshd'
// after
statics:
  - meta: service
    expression: evt.Parsed.service == 'ssh' ? 'sshd' : 'other'

for _, st := range statics {
    if st.ExpValue != "" {
        if _, err := expr.Compile(st.ExpValue, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...); err != nil {
            return fmt.Errorf("static %q: %w", st.ExpValue, err)
        }
    }
}

rt, err := static.Compile()
if err != nil {
    if strings.Contains(err.Error(), "compiling static expression") { /* fix expression: */ }
    return err
}

When it happens

Trigger: A statics entry with `expression:` set (in a parser node or enricher statics) contains invalid expr syntax or references unknown fields; Compile is invoked during parser loading.

Common situations: Typos in field names (`evt.Parsed.sourceip`), unbalanced parentheses, use of functions not registered in exprhelpers.

Related errors

• compilation of %q failed: %v
• stash %s: %w
• while compiling stash value expression: %w
• while compiling stash key expression: %w
• unable to compile filter %s : %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/422157ccb26779df. Report an issue: GitHub.