crowdsecurity/crowdsec · error

%s: key expression must be set

Error message

%s: key expression must be set

What it means

Stash.Validate() requires a `key` expression, which computes the cache key under which the value is stored. An empty key means entries could not be looked up, so the stash config is rejected, with the stash name in the message.

Source

Thrown at pkg/parser/stash.go:43

type RuntimeStash struct {
	Config          *Stash
	KeyExpression   *vm.Program
	ValueExpression *vm.Program
	TTLVal          time.Duration
}

func (s *Stash) Validate() error {
	if s.Name == "" {
		return errors.New("name must be set")
	}

	if s.Value == "" {
		return fmt.Errorf("%s: value expression must be set", s.Name)
	}

	if s.Key == "" {
		return fmt.Errorf("%s: key expression must be set", s.Name)
	}

	if s.TTL == "" {
		return fmt.Errorf("%s: ttl must be set", s.Name)
	}

	if s.Strategy == "" {
		s.Strategy = "LRU"
	}

	// should be configurable
	if s.MaxMapSize == 0 {
		s.MaxMapSize = 100
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `key:` expr expression to the stash, e.g. `key: evt.Parsed.src_ip`.
2. Ensure the YAML field is spelled `key` and indented under the correct stash entry.
3. Reload the configuration to confirm validation passes.

Example fix

// before
- name: my-stash
  value: evt.Parsed.src_ip
  ttl: 1h
// after
- name: my-stash
  key: evt.Parsed.src_ip
  value: evt.Parsed.src_ip
  ttl: 1h

if s.Key == "" { return fmt.Errorf("stash %q: key expression required", s.Name) }

if err := stash.Validate(); err != nil {
    return fmt.Errorf("invalid stash config: %w", err)
}

When it happens

Trigger: A `stash:` stanza sets name/value/ttl but leaves `key:` empty or absent; Validate() is invoked during configuration load/validation.

Common situations: Copy-pasting a stash example and deleting the key line; YAML key named `keys` (plural) by mistake so `key` stays empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• %s: value expression must be set
• %s: ttl must be set
• onsuccess %q not continue,next_stage
• stash %d: %w
• while parsing stash ttl: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/92b547d1b63a98ff. Report an issue: GitHub.