crowdsecurity/crowdsec · error

onsuccess %q not continue,next_stage

Error message

onsuccess %q not continue,next_stage

What it means

Node.validate() checks that a parser node's on_success directive is one of the allowed values: "continue", "next_stage", or empty ("" behaves like continue). Any other string is rejected at config load time so invalid parser trees fail fast instead of misbehaving at runtime.

Source

Thrown at pkg/parser/node.go:76

		return
	}
	n.LeavesNodes = make([]Node, len(subNodes))
	for i := range subNodes {
		child := Node{NodeConfig: subNodes[i]}
		child.initRuntimeChildrenFromConfig()
		n.LeavesNodes[i] = child
	}
}

func (n *Node) validate(ectx EnricherCtx) error {
	// stage is being set automagically
	if n.Stage == "" {
		return errors.New("stage needs to be an existing stage")
	}

	/* "" behaves like continue */
	if n.OnSuccess != "continue" && n.OnSuccess != "next_stage" && n.OnSuccess != "" {
		return fmt.Errorf("onsuccess %q not continue,next_stage", n.OnSuccess)
	}

	if n.Filter != "" && n.RunTimeFilter == nil {
		return fmt.Errorf("non-empty filter %q was not compiled", n.Filter)
	}

	if n.RuntimeGrok.RunTimeRegexp != nil || n.Grok.TargetField != "" {
		if err := n.Grok.Validate(); err != nil {
			return err
		}
	}

	for idx, static := range n.Statics {
		if err := static.Validate(ectx); err != nil {
			return fmt.Errorf("static %d: %w", idx, err)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Change on_success in the parser node YAML to exactly "continue" or "next_stage" (lowercase).
2. Remove the on_success key entirely to get the default (continue) behavior.
3. Check hub collection docs for the correct on_success semantics.

Example fix

// before (parser yaml)
onsuccess: continue_if_matched
// after
onsuccess: continue

var validOnSuccess = map[string]bool{"": true, "continue": true, "next_stage": true}
if !validOnSuccess[strings.TrimSpace(node.YAMLOnSuccess)] {
    return fmt.Errorf("onsuccess %q must be continue or next_stage", node.YAMLOnSuccess)
}

if err := nodes.Load(yaml, pctx); err != nil {
    if strings.Contains(err.Error(), "onsuccess") {
        logger.Errorf("invalid on_success keyword in parser config; use continue or next_stage: %v", err)
    }
    return err
}

When it happens

Trigger: validate() (called by compile and tests) reads n.OnSuccess with a value other than continue/next_stage/empty, e.g. "filter" or "continue_on_failure" in a parser YAML node.

Common situations: Typo in a custom parser config (onsuccess: contnue); copying on_success values from enricher/stash syntaxes that allow different keywords; writing camelCase or mixed-case values where only lowercase are accepted.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• path must start with /
• no credentials or URL found in api client configuration '%s'
• unable to find grok %q: %v
• non-empty filter %q was not compiled
• static %d: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d5e1ca750a6fea61. Report an issue: GitHub.