crowdsecurity/crowdsec · error

failed to compile node '%s' in '%s' : %s

Error message

failed to compile node '%s' in '%s' : %s

What it means

Wraps an error from node.compile() while loading a parser stage file in processStageFile. The node's YAML was valid, but compiling its filter/grok/stash failed (see errors 1211/1212). The message includes the node name and file when known, so the offending parser entry is directly locatable.

Source

Thrown at pkg/parser/stage.go:138

		}

		ok, err := constraint.Satisfies(node.FormatVersion, constraint.Parser)
		if err != nil {
			return nil, fmt.Errorf("failed to check version : %s", err)
		}

		if !ok {
			log.Errorf("%s : %s doesn't satisfy parser format %s, skip", node.Name, node.FormatVersion, constraint.Parser)
			continue
		}

		node.Stage = stageFile.Stage
		// compile the node : grok pattern and expression

		err = node.compile(pctx, ectx)
		if err != nil {
			if node.Name != "" {
				return nil, fmt.Errorf("failed to compile node '%s' in '%s' : %s", node.Name, stageFile.Filename, err)
			}

			return nil, fmt.Errorf("failed to compile node in '%s' : %s", stageFile.Filename, err)
		}
		/* if the stage is empty, the node is empty, it's a trailing entry in users yaml file */
		if node.Stage == "" {
			continue
		}

		for _, data := range node.Data {
			err = exprhelpers.FileInit(pctx.DataFolder, data.DestPath, data.Type)
			if err != nil {
				log.Error(err.Error())
			}

			if data.Type == "regexp" { // cache only makes sense for regexp
				if err = exprhelpers.RegexpCacheInit(data.DestPath, *data); err != nil {
					log.Error(err.Error())

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error — it names the failing filter/grok/stash (see also errors 1211/1212)
2. Test the parser file in isolation with `cscli hubtool test` on a sample log
3. Fix the offending expression/pattern in the YAML, or reinstall the parser from the hub
4. If a hub parser fails after a CrowdSec upgrade, `cscli hub update && cscli hub upgrade` to get compatible parser versions

Example fix

# before (node with broken filter blocks startup)
filter: evt.Parsed.foo =~
# after
filter: evt.Parsed.foo contains 'bar'

// pre-compile check before install
var node parser.Node
// ... yaml decode ...
if err := node.compile(pctx, ectx); err != nil {
    return fmt.Errorf("parser not installable: %w", err)
}

if _, err := processStageFile(sf, pctx, ectx); err != nil {
    log.Errorf("stage %s failed to load: %v", sf.Stage, err)
    return nil, err
}

When it happens

Trigger: Calling processStageFile (via LoadStages) when node.compile(pctx, ectx) returns an error: uncompilable filter expression, bad grok pattern definitions, or failing stash compilation for that node.

Common situations: Third-party/custom parsers with expr or grok syntax errors, hub updates referencing expr helpers absent in the installed CrowdSec version, local overrides with an invalid filter that break stage loading at startup.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• failed to load parser patterns: %w
• failed to load postovflw parser patterns: %w
• failed to load parser config: %w
• no configuration paths provided
• compilation of '%s' context value failed: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a3e3db72cfe509f7. Report an issue: GitHub.