crowdsecurity/crowdsec · error

grok requires 'expression' or 'apply_on'

Error message

grok requires 'expression' or 'apply_on'

What it means

GrokPattern.Validate() requires that a grok node actually targets something: at least one of TargetField (apply_on) or ExpValue (expression) must be non-empty, otherwise the pattern has no input to match against and would be meaningless at parse time.

Source

Thrown at pkg/parser/grok.go:90

	}

	/* load grok statics */
	// compile expr statics if present
	for _, static := range g.Statics {
		compiled, err := static.Compile()
		if err != nil {
			return nil, err
		}

		rg.RuntimeStatics = append(rg.RuntimeStatics, *compiled)
	}

	return rg, nil
}

func (g *GrokPattern) Validate() error {
	if g.TargetField == "" && g.ExpValue == "" {
		return errors.New("grok requires 'expression' or 'apply_on'")
	}

	if g.RegexpName == "" && g.RegexpValue == "" {
		return errors.New("grok needs 'pattern' or 'name'")
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add apply_on to the grok node naming the field to match (e.g. evt.Raw or evt.Meta.field).
2. Or add an expression whose result supplies the value to apply the grok on.
3. Fix key typos so the YAML unmarshals into TargetField/ExpValue.

Example fix

// before
grok:
  name: SYSLOGLINE
// after
grok:
  name: SYSLOGLINE
  apply_on: message

if grok.TargetField == "" && grok.ExpValue == "" {
    return errors.New("grok stanza needs 'apply_on' or 'expression'")
}

if err := grokPattern.Validate(); err != nil {
    return fmt.Errorf("parser node %s invalid: %w", nodeName, err)
}

When it happens

Trigger: Calling GrokPattern.Validate() on a parser node where both 'apply_on' (target field) and 'expression' (ExpValue) are empty/missing strings, e.g. a grok stanza in a parser YAML defining only the pattern/name.

Common situations: Hand-written parser YAML with a grok section missing the apply_on key, an expression key typo'd (e.g. 'expr'), or programmatically built GrokPattern structs with unset fields.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• group_name is mandatory for CloudwatchSource
• filter is not allowed for IP scope
• filter is mandatory for non-IP, non-Range scope
• ErrInvalidMetricsLevel
• cannot parse: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/dc4962e094348df1. Report an issue: GitHub.