crowdsecurity/crowdsec · error

could not compile regexp %s: %w

Error message

could not compile regexp %s: %w

What it means

UnmarshalConfig compiles each entry of exclude_regexps with Go's regexp.Compile; an invalid pattern returns "could not compile regexp %s: %w". Go RE2 syntax differs from PCRE, so patterns valid elsewhere can fail here.

Source

Thrown at pkg/acquisition/modules/file/config.go:66

		s.config.Filenames = append(s.config.Filenames, s.config.Filename)
	}

	if len(s.config.Filenames) == 0 {
		return errors.New("no filename or filenames configuration provided")
	}

	if s.config.Mode == "" {
		s.config.Mode = configuration.TAIL_MODE
	}

	if s.config.Mode != configuration.CAT_MODE && s.config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for file source", s.config.Mode)
	}

	for _, exclude := range s.config.ExcludeRegexps {
		re, err := regexp.Compile(exclude)
		if err != nil {
			return fmt.Errorf("could not compile regexp %s: %w", exclude, err)
		}

		s.exclude_regexps = append(s.exclude_regexps, re)
	}

	return nil
}

func (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	s.watchedDirectories = make(map[string]bool)

View on GitHub (pinned to 909b515798)

Solutions

1. Validate the pattern with Go semantics: `go run` a snippet with regexp.Compile, or test at https://regex101.com with the Golang flavor.
2. Fix unbalanced delimiters/dangling quantifiers reported in the wrapped error.
3. Replace unsupported PCRE constructs (lookbehinds, backreferences) with RE2-compatible alternatives (e.g. multiple exclude_regexps entries).
4. Quote backslashes properly in YAML (single quotes) so `\.` reaches the compiler intact.

Example fix

// before
exclude_regexps:
  - '(?<=error)denied'   # RE2 has no lookbehind
// after
exclude_regexps:
  - 'error.*denied'

// Go: compile-check every exclude pattern before writing config
for _, pat := range cfg.ExcludeRegexps {
	if _, err := regexp.Compile(pat); err != nil {
		return fmt.Errorf("exclude_regexps entry invalid: %w", err)
	}
}

if err := src.UnmarshalConfig(cfgYAML); err != nil {
	var reErr *regexp.SyntaxError
	if errors.As(err, &reErr) || strings.Contains(err.Error(), "could not compile regexp") {
		// fix the named pattern (RE2 flavor), then retry
	}
}

When it happens

Trigger: exclude_regexps entries containing invalid RE2 syntax: dangling quantifiers (`*foo`), unmatched `(` or `[`, invalid escape sequences like `\d` is fine but `\p{...}` typos or `(?<=...)` lookbehinds are rejected by RE2.

Common situations: Copying PCRE lookbehind/lookahead patterns that RE2 doesn't support; quoting issues in YAML leaving literal backslashes; hand-written patterns with an unbalanced bracket; patterns intended for filepath matching (globs) pasted as regexps.

Related errors

• cannot parse FileAcquisition configuration: %s
• unsupported mode %s for file source
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/efa16596a42f9046. Report an issue: GitHub.