crowdsecurity/crowdsec · error

service_id_regexp: %w

Error message

service_id_regexp: %w

What it means

During UnmarshalConfig, each `service_id_regexp` entry is compiled with regexp.Compile; a failing compile aborts startup with this wrapped error. It means one of the service_id_regexp values is not a valid Go (RE2) regular expression.

Source

Thrown at pkg/acquisition/modules/docker/config.go:122

			return fmt.Errorf("container_id_regexp: %w", err)
		}

		d.compiledContainerID = append(d.compiledContainerID, compiled)
	}

	for _, svc := range d.Config.ServiceNameRegexp {
		compiled, err := regexp.Compile(svc)
		if err != nil {
			return fmt.Errorf("service_name_regexp: %w", err)
		}

		d.compiledServiceName = append(d.compiledServiceName, compiled)
	}

	for _, svc := range d.Config.ServiceIDRegexp {
		compiled, err := regexp.Compile(svc)
		if err != nil {
			return fmt.Errorf("service_id_regexp: %w", err)
		}

		d.compiledServiceID = append(d.compiledServiceID, compiled)
	}

	if d.Config.Since == "" {
		d.Config.Since = time.Now().UTC().Format(time.RFC3339)
	}

	d.containerLogsOptions = &client.ContainerLogsOptions{
		ShowStdout: d.Config.FollowStdout,
		ShowStderr: d.Config.FollowStdErr,
		Follow:     true,
		Since:      d.Config.Since,
	}

	if d.Config.Until != "" {
		d.containerLogsOptions.Until = d.Config.Until

View on GitHub (pinned to 909b515798)

Solutions

1. Correct the regex syntax so it compiles under Go regexp.
2. Drop RE2-unsupported constructs (backreferences, lookarounds).
3. Validate with `regexp.Compile(pattern)` in a snippet or `go run` before deploying.
4. Use `service_id` (exact list) when a regex is unnecessary.

Example fix

// before
service_id_regexp:
  - "^[abc{"   // invalid character class
// after
service_id_regexp:
  - "^[a-f0-9]{12}$"

for _, re := range cfg.ServiceIDRegexp {
    if _, err := regexp.Compile(re); err != nil {
        return fmt.Errorf("invalid service_id_regexp %q: %w", re, err)
    }
}

When it happens

Trigger: Configure/UnmarshalConfig called with d.Config.ServiceIDRegexp containing an invalid pattern string rejected by regexp.Compile.

Common situations: Typo in a Swarm service ID filter regex in acquis.yaml or DSN; using unsupported regex syntax copied from another tool; missing escape on characters like `+` or `{`.

Related errors

• container_name_regexp: %w
• container_id_regexp: %w
• service_name_regexp: %w
• while parsing DockerAcquisition configuration: %s
• unsupported mode %s for docker datasource

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7376ec01fdb46a9a. Report an issue: GitHub.