crowdsecurity/crowdsec · error

leaky failed :/

Error message

leaky failed :/

What it means

PourItemToHolders evaluates the bucket's groupby expression via exprhelpers.Run to partition buckets by key; if the expression itself errors (compile/runtime failure), pouring is aborted and this opaque error is returned.

Source

Thrown at pkg/leakybucket/manager_run.go:250

			}
			// we assume we a bool should add type check here
			if condition, ok = output.(bool); !ok {
				holders[idx].logger.Errorf("unexpected non-bool return : %T", output)
				holders[idx].logger.Fatalf("Filter issue")
			}
			if !condition {
				holders[idx].logger.Debugf("Event leaving node : ko (filter mismatch)")
				continue
			}
		}

		// groupby determines the partition key for the specific bucket
		var groupby string
		if holders[idx].RunTimeGroupBy != nil {
			tmpGroupBy, err := exprhelpers.Run(holders[idx].RunTimeGroupBy, map[string]any{"evt": &parsed}, holders[idx].logger, holders[idx].Spec.Debug)
			if err != nil {
				holders[idx].logger.Errorf("failed groupby : %v", err)
				return false, errors.New("leaky failed :/")
			}

			if groupby, ok = tmpGroupBy.(string); !ok {
				holders[idx].logger.Fatalf("failed groupby type : %v", err)
				return false, errors.New("groupby wrong type")
			}
		}
		buckey := holders[idx].BucketKey(groupby)

		// we need to either find the existing bucket, or create a new one (if it's the first event to hit it for this partition key)
		bucket, err := LoadOrStoreBucketFromHolder(ctx, buckey, buckets, &holders[idx], parsed.ExpectMode)
		if err != nil {
			return false, fmt.Errorf("failed to load or store bucket: %w", err)
		}
		// finally, pour the even into the bucket

		if bucket.Factory.orderEvent {
			if orderEvent == nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the `groupby:` expression in the scenario so it compiles and never errors on the event shapes you feed (guard with coalescing, e.g. `evt.Meta.source_ip` fields that always exist)
2. Check crowdsec logs for the preceding 'failed groupby' line to see the real underlying expr error
3. Test the scenario with `cscli hubtest` before deploying

Example fix

# before
groupby: "evt.Meta.nonexistent_field"
# after
groupby: "evt.Meta.source_ip"

// ensure groupby only references fields present on all event shapes
ok, err := exprhelpers.Compile("evt.Meta.source_ip", nil)
if err != nil || !ok { return err }

if _, pourErr := PourItemToHolders(ctx, parsed, holders, buckets); pourErr != nil {
    log.Printf("pour failed: %v; check scenario groupby/filter expressions", pourErr)
    return pourErr
}

When it happens

Trigger: An event is poured into a bucket whose RunTimeGroupBy expression fails to evaluate (bad syntax at compile, nil field access, or wrong data types at runtime).

Common situations: Groupby referencing a nonexistent event field (e.g. evt.Meta.target_user on events lacking it), or a malformed expr expression in the scenario's `groupby:` directive.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• missing filter directive
• groupby wrong type
• while running scope filter: %w
• AverageInterval expects exactly one parameter: a slice of ti
• AverageInterval expects a slice of times

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/dc42a4cfd46bd4a3. Report an issue: GitHub.