crowdsecurity/crowdsec · error

no match value defined

Error message

no match value defined

What it means

CustomRule.Convert requires a non-empty match value for leaf rules. A rule that declares zones and a match type but leaves `match.value` empty cannot be compiled into a concrete detection rule, so Convert rejects it. Like the other Convert checks, it is skipped when the rule has `and`/`or` children.

Source

Thrown at pkg/appsec/appsec_rule/appsec_rule.go:61

	And       []CustomRule `yaml:"and,omitempty"`
	Or        []CustomRule `yaml:"or,omitempty"`

	BodyType string `yaml:"body_type,omitempty"`
}

// Convert renders the rule; ruleIndex is its position in the collection, used
// to keep ids unique across rules that share identical leaves.
func (v *CustomRule) Convert(ruleType string, appsecRuleName string, appsecRuleDescription string, ruleIndex int) (string, []uint32, error) {
	if v.Zones == nil && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no zones defined")
	}

	if v.Match.Type == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match type defined")
	}

	if v.Match.Value == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match value defined")
	}

	switch ruleType {
	case ModsecurityRuleType:
		r := ModsecurityRule{}
		return r.Build(v, appsecRuleName, appsecRuleDescription, ruleIndex)
	default:
		return "", nil, fmt.Errorf("unknown rule format '%s'", ruleType)
	}
}

View on GitHub (pinned to 909b515798)

Solutions

1. Provide a match value, e.g. `match: {type: contains, value: /wp-admin}`
2. If the value comes from a variable, ensure it is set and non-empty at load time
3. For regex rules, supply the pattern in match.value

Example fix

// before
- zones:
    - URI
  match:
    type: contains

// after
- zones:
    - URI
  match:
    type: contains
    value: /wp-admin

if rule.Match.Type != "" && rule.Match.Value == "" {
    return fmt.Errorf("rule %q: match.value must not be empty", rule.Name)
}

When it happens

Trigger: Defining `zones:` and `match.type:` but omitting `match.value:` (or the value being an empty string after variable/interpolation expansion), then calling Convert during collection load.

Common situations: A YAML template where the value field was left blank; environment/variable substitution producing an empty string; copy-pasting a rule skeleton without filling in the value.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• no zones defined
• no match type defined
• leaf rule must have zones
• rule has no zones, 'and', or 'or' children
• invalid schema name

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e59de989209e75a1. Report an issue: GitHub.