crowdsecurity/crowdsec · error

%s: value expression must be set

Error message

%s: value expression must be set

What it means

Stash.Validate() checks that every stash configuration stanza defines a value expression, which is what gets stored in the stash cache when the stash fires. If `value` is empty the stash has nothing to store, so configuration loading fails with the stash name prefixed for identification.

Source

Thrown at pkg/parser/stash.go:39

	TTL        string `yaml:"ttl,omitempty"`
	MaxMapSize int    `yaml:"size,omitempty"`
	Strategy   string `yaml:"strategy,omitempty"`
}

type RuntimeStash struct {
	Config          *Stash
	KeyExpression   *vm.Program
	ValueExpression *vm.Program
	TTLVal          time.Duration
}

func (s *Stash) Validate() error {
	if s.Name == "" {
		return errors.New("name must be set")
	}

	if s.Value == "" {
		return fmt.Errorf("%s: value expression must be set", s.Name)
	}

	if s.Key == "" {
		return fmt.Errorf("%s: key expression must be set", s.Name)
	}

	if s.TTL == "" {
		return fmt.Errorf("%s: ttl must be set", s.Name)
	}

	if s.Strategy == "" {
		s.Strategy = "LRU"
	}

	// should be configurable
	if s.MaxMapSize == 0 {
		s.MaxMapSize = 100
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `value:` expr expression to the stash stanza named in the error, e.g. `value: evt.Parsed.src_ip`.
2. Check for YAML indentation issues that detached the value from the `value:` key.
3. Re-run `cscli` / restart crowdsec to confirm the stash validates.

Example fix

// before
stashes:
  - name: my-stash
    key: evt.Parsed.src_ip
    ttl: 1h
// after
stashes:
  - name: my-stash
    key: evt.Parsed.src_ip
    value: evt.Parsed.src_ip
    ttl: 1h

for i, s := range stashes {
    if s.Value == "" { return fmt.Errorf("stash[%d] %q: value expression required", i, s.Name) }
}

if err := stash.Validate(); err != nil {
    return fmt.Errorf("invalid stash config: %w", err)
}

When it happens

Trigger: A `stash:` entry in a parser/enricher stage (or profile) declares `name:` but omits the `value:` expression; Validate() runs during config load (reached e.g. via UsageMetrics validation path).

Common situations: Hand-written stash config where the user only set name/key/ttl and forgot `value`; a partially commented-out YAML block that left `value:` with nothing after it.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• %s: key expression must be set
• %s: ttl must be set
• onsuccess %q not continue,next_stage
• stash %d: %w
• while parsing stash ttl: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7dcb903fc46f0a52. Report an issue: GitHub.