crowdsecurity/crowdsec · error

filter is not allowed for IP scope

Error message

filter is not allowed for IP scope

What it means

Scope compile-time validation in leakybucket. When a bucket's scope is 'Ip' (or undefined, which defaults to Ip), the scope-level filter must be empty, because IP scope deduplicates events purely on the source IP extracted by the parser; a filter expression makes no sense there and would silently change bucket semantics.

Source

Thrown at pkg/leakybucket/scopetype.go:25

	"github.com/expr-lang/expr/vm"

	"github.com/crowdsecurity/crowdsec/pkg/types"
)

type ScopeType struct {
	Scope         string `yaml:"type"`
	Filter        string `yaml:"expression"`
	RunTimeFilter *vm.Program
}

func (s *ScopeType) CompileFilter() error {
	if s.Scope == types.Undefined {
		s.Scope = types.Ip
	}

	if s.Scope == types.Ip {
		if s.Filter != "" {
			return errors.New("filter is not allowed for IP scope")
		}

		return nil
	}

	if s.Scope == types.Range && s.Filter == "" {
		return nil
	}

	if s.Filter == "" {
		return errors.New("filter is mandatory for non-IP, non-Range scope")
	}

	runTimeFilter, err := compile(s.Filter, nil)
	if err != nil {
		return fmt.Errorf("error compiling the scope filter: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Remove the scope filter (expression) from the bucket configuration since IP scope derives the key from the parsed source IP.
2. If filtering is actually needed, change the scope type to a non-IP, non-Range scope (e.g. use a filter on a different scope) so a filter is valid.
3. Use the event-level 'filter' in the scenario definition instead of the scope-level filter to restrict which events are counted.

Example fix

// before
scope:
  type: ip
  expression: evt.Meta.service == 'ssh'
// after
scope:
  type: ip
# move the condition to the scenario-level filter if needed:
# filter: evt.Meta.service == 'ssh'

if scope.Scope == types.Ip && scope.Filter != "" {
    return errors.New("remove scope filter when using ip scope")
}

When it happens

Trigger: Calling Scope.CompileFilter() on a scope whose Scope field is types.Ip (or types.Undefined) while s.Filter is a non-empty string — typically from a bucket config that declares scope: type: ip together with an expression field.

Common situations: Writing a custom scenario YAML and adding an 'expression' under the scope section, copying a non-IP scope config and switching type to ip without removing the filter, or programmatic bucket construction where the filter is set before the scope type.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• filter is mandatory for non-IP, non-Range scope
• group_name is mandatory for CloudwatchSource
• path must start with /
• invalid filter
• leakspeed is required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/81fd463b776a353b. Report an issue: GitHub.