crowdsecurity/crowdsec · warning

failed to get value for %s: %w

Error message

failed to get value for %s: %w

What it means

EvalAlertContextRules runs each compiled context expression with expr.Run against the live {match, evt, req} environment. If evaluation fails at runtime (nil pointer on a missing field, type error such as comparing string to int, calling a method on a nil evt/unmarshaled struct), the error is collected per key as 'failed to get value for %s: %w' and that key is omitted from the alert context while the rest continue to be evaluated.

Source

Thrown at pkg/alertcontext/alertcontext.go:184

	}

	if request == nil {
		request = &http.Request{}
	}

	ac := getAlertContext()

	for key, values := range ac.ContextToSendCompiled {
		if _, ok := tmpContext[key]; !ok {
			tmpContext[key] = make([]string, 0)
		}

		for _, value := range values {
			var val string

			output, err := expr.Run(value, map[string]any{"match": match, "evt": evt, "req": request})
			if err != nil {
				errors = append(errors, fmt.Errorf("failed to get value for %s: %w", key, err))
				continue
			}

			switch out := output.(type) {
			case string:
				val = out
				if val != "" && !slices.Contains(tmpContext[key], val) {
					tmpContext[key] = append(tmpContext[key], val)
				}
			case []string:
				for _, v := range out {
					if v != "" && !slices.Contains(tmpContext[key], v) {
						tmpContext[key] = append(tmpContext[key], v)
					}
				}
			case int:
				val = strconv.Itoa(out)
				if val != "" && !slices.Contains(tmpContext[key], val) {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %w error for the failing key and make the expression nil/type-safe (use the 'in' operator, default values, or string coercion)
2. Guard optional fields: e.g. use 'evt.Meta.source_ip in ["1.2.3.4"]' style checks instead of direct arithmetic on possibly absent values
3. Test the expression against both pipeline and appsec event shapes with cscli explain or unit tests
4. Check that the exprhelpers builtin used exists and handles the runtime type (string vs int) for this event

Example fix

# before (fails when evt.Unmarshaled is empty)
context:
  ua: evt.Unmarshaled.appsec.http_user_agent
# after
context:
  ua: len(evt.Unmarshaled.appsec) > 0 ? evt.Unmarshaled.appsec.http_user_agent : ""

// pre-check compiled exprs against sample data
testEnv := map[string]any{"match": &pipeline.MatchedRule{}, "evt": &pipeline.Event{}, "req": &http.Request{}}
for _, v := range ac.ContextToSendCompiled {
    if _, err := expr.Run(v[0], testEnv); err != nil { log.Warnf("expr fails on empty evt") }
}

ctx, errs := ac.EvalAlertContextRules(evt, match, req)
if len(errs) > 0 {
    for _, e := range errs { log.Warnf("context key omitted: %v", e) }
    // continue: alert is still sent with the keys that evaluated
}

When it happens

Trigger: AppsecEventToContext/EventToContext invoke it per alert; expr.Run fails for a compiled value — e.g. evt.Meta.key is absent and the expression dereferences it unsafely, a type mismatch between operands, or a custom method in exprhelpers returning an error on this particular event shape.

Common situations: AppSec events where match/req fields differ from pipeline expectations; expressions written for parser events evaluated against appsec alerts; missing evt.Unmarshaled sections because the event was synthesized rather than parsed; wrong assumed types (e.g. int arithmetic on string meta values).

Related errors

• leaky failed :/
• while running expression %s: %w
• while running expression %s: %w
• while running scope filter: %w
• context must be non-nil

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f7f00998e1f1f21c. Report an issue: GitHub.