crowdsecurity/crowdsec · error

error compiling filter of '%s': %w

Error message

error compiling filter of '%s': %w

What it means

NewProfile compiles each profile filter expression with the expr library (with an Alert variable in scope); a syntactically or semantically invalid expression causes this wrapped error and aborts startup.

Source

Thrown at pkg/csprofiles/csprofiles.go:58

		runtime.Logger = xlog.WithFields(log.Fields{
			"type": "profile",
			"name": profile.Name,
		})

		runtime.RuntimeFilters = make([]*vm.Program, len(profile.Filters))
		runtime.Cfg = profile

		if runtime.Cfg.OnSuccess != "" && runtime.Cfg.OnSuccess != "continue" && runtime.Cfg.OnSuccess != "break" {
			return nil, fmt.Errorf("invalid 'on_success' for '%s': %s", profile.Name, runtime.Cfg.OnSuccess)
		}

		if runtime.Cfg.OnFailure != "" && runtime.Cfg.OnFailure != "continue" && runtime.Cfg.OnFailure != "break" && runtime.Cfg.OnFailure != "apply" {
			return nil, fmt.Errorf("invalid 'on_failure' for '%s' : %s", profile.Name, runtime.Cfg.OnFailure)
		}

		for fIdx, filter := range profile.Filters {
			if runtimeFilter, err = expr.Compile(filter, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
				return nil, fmt.Errorf("error compiling filter of '%s': %w", profile.Name, err)
			}

			runtime.RuntimeFilters[fIdx] = runtimeFilter
			if profile.Debug != nil && *profile.Debug {
				runtime.Logger.Logger.SetLevel(log.DebugLevel)
			}
		}

		if profile.DurationExpr != "" {
			if runtimeDurationExpr, err = expr.Compile(profile.DurationExpr, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
				return nil, fmt.Errorf("error compiling duration_expr of %s: %w", profile.Name, err)
			}

			runtime.RuntimeDurationExpr = runtimeDurationExpr
		}

		for _, decision := range profile.Decisions {
			if runtime.RuntimeDurationExpr == nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped underlying expr error to find the failing token/variable in the filter.
2. Test the filter expression with 'cscli explain' or a small expr playground using models.Alert as context.
3. Fix or remove the offending filter in profiles.yaml (or the hub profile file) — check function names against pkg/exprhelpers registered functions.

Example fix

// before
filter: Alert.GetEvent() and Alert.GetScenario() in ['http-bf']
// after
filter: Alert.GetScenario() in ['crowdsecurity/http-bf']

for _, f := range profile.Filters {
	if _, err := expr.Compile(f, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
		return fmt.Errorf("bad profile filter %q: %w", f, err)
	}
}

if _, err := csprofiles.New(...); err != nil {
	var werr error
	if errors.As(err, &werr) { /* inspect wrapped expr compile error */ }
}

When it happens

Trigger: Calling NewProfile with a profile whose Filters contain an expression that expr.Compile rejects: unknown variables/functions, syntax errors, type errors against models.Alert, or use of helpers absent from exprhelpers.GetExprOptions.

Common situations: Typos in field names (e.g. Alert.Source not Alert Sources); using functions not registered in exprhelpers; referencing event fields that don't exist on Alert; version changes removing a helper function; unbalanced parens or quotes in profiles.yaml.

Related errors

• filter is mandatory for non-IP, non-Range scope
• invalid 'on_success' for '%s': %s
• invalid 'on_failure' for '%s' : %s
• missing lapi client credentials
• no appsec_config provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/94ec3d4cbfe0b2c1. Report an issue: GitHub.