crowdsecurity/crowdsec · error

error compiling the scope filter: %w

Error message

error compiling the scope filter: %w

What it means

ScopeType.CompileFilter validates and compiles the scope filter expression for non-IP, non-Range scopes. A filter is mandatory there, and compile() (expr compilation, not evaluation) turns the expression into a runnable form. If the expression has syntax errors or references unknown functions/variables, compilation fails and this error wraps the compile error. It happens at hub-item load time, before any event is processed.

Source

Thrown at pkg/leakybucket/scopetype.go:41

	if s.Scope == types.Ip {
		if s.Filter != "" {
			return errors.New("filter is not allowed for IP scope")
		}

		return nil
	}

	if s.Scope == types.Range && s.Filter == "" {
		return nil
	}

	if s.Filter == "" {
		return errors.New("filter is mandatory for non-IP, non-Range scope")
	}

	runTimeFilter, err := compile(s.Filter, nil)
	if err != nil {
		return fmt.Errorf("error compiling the scope filter: %w", err)
	}

	s.RunTimeFilter = runTimeFilter

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped compile error for the exact syntax problem and character offset
2. Validate the expression syntax (balanced parens, correct field paths like evt.Parsed.x)
3. Only use functions available in crowdsec's expr environment (see exprhelpers)
4. Reload the hub after fixing; the bucket will fail to compile until then

Example fix

// before
scope:
  type: custom
  filter: evt.Parsed.user &&
// after
scope:
  type: custom
  filter: evt.Parsed.user != ''

// Compile-check the expression at load time in your own tooling:
_, err := expr.Compile(scopeFilter, expr.Env(map[string]any{"evt": &models.Event{}}))
if err != nil { return fmt.Errorf("scope filter invalid: %w", err) }

if err := scopeType.CompileFilter(); err != nil {
    log.Errorf("rejecting hub item, bad scope filter: %v", err)
    return err
}

When it happens

Trigger: Loading a scenario/profile whose scope type requires a filter (filter empty → 'filter is mandatory' wrapped as the compile error, or a syntactically invalid expression / unknown expr function passed to compile(s.Filter, nil)).

Common situations: Typo in scope_filter YAML; unbalanced parentheses; using a function not registered in exprhelpers; YAML indentation merging the filter with another key; broken hub item after manual edit.

Related errors

• while running scope filter: %w
• AverageInterval expects exactly one parameter: a slice of ti
• AverageInterval expects a slice of times
• need at least two times to calculate an average interval
• missing filter directive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8680686caea70ec3. Report an issue: GitHub.