crowdsecurity/crowdsec · error

no match type defined

Error message

no match type defined

What it means

CustomRule.Convert requires a non-empty match type for leaf rules (e.g. contains, regex, equals). A rule that declares zones but has no `match.type` cannot be compiled, so Convert rejects it. This only fires for standalone leaf rules, not for rules that delegate matching to `and`/`or` children.

Source

Thrown at pkg/appsec/appsec_rule/appsec_rule.go:57

	Variables []string `yaml:"variables"`

	Match     Match        `yaml:"match"`
	Transform []string     `yaml:"transform"` //t:lowercase, t:uppercase, etc
	And       []CustomRule `yaml:"and,omitempty"`
	Or        []CustomRule `yaml:"or,omitempty"`

	BodyType string `yaml:"body_type,omitempty"`
}

// Convert renders the rule; ruleIndex is its position in the collection, used
// to keep ids unique across rules that share identical leaves.
func (v *CustomRule) Convert(ruleType string, appsecRuleName string, appsecRuleDescription string, ruleIndex int) (string, []uint32, error) {
	if v.Zones == nil && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no zones defined")
	}

	if v.Match.Type == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match type defined")
	}

	if v.Match.Value == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match value defined")
	}

	switch ruleType {
	case ModsecurityRuleType:
		r := ModsecurityRule{}
		return r.Build(v, appsecRuleName, appsecRuleDescription, ruleIndex)
	default:
		return "", nil, fmt.Errorf("unknown rule format '%s'", ruleType)
	}
}

View on GitHub (pinned to 909b515798)

Solutions

1. Set a valid match type, e.g. `match: {type: contains, value: ...}`
2. Verify the `match:` mapping is not nested/indented into a sibling key
3. Refer to the supported match types (contains, regex, equals, starts_with, etc.) in the docs

Example fix

// before
- zones:
    - URI
  match:
    value: bad-string

// after
- zones:
    - URI
  match:
    type: contains
    value: bad-string

if len(rule.Zones) > 0 && rule.Match.Type == "" {
    return fmt.Errorf("rule %q: zones set but match.type is empty", rule.Name)
}

When it happens

Trigger: Defining a rule with `zones:` but missing or empty `match.type`, e.g. only `match.value:` given; Convert is called during collection loading (as in the appsec_rule unit tests).

Common situations: Typo like `type: contains_any` misspelled to empty; a copy-paste that dropped the `type:` key; dynamically generated rules where match type interpolation produced an empty string.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• no zones defined
• no match value defined
• leaf rule must have zones
• rule has no zones, 'and', or 'or' children
• invalid schema name

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/73fa317031a1eaf2. Report an issue: GitHub.