crowdsecurity/crowdsec · error

stash %d: %w

Error message

stash %d: %w

What it means

Wraps an error returned by validating one of a parser node's stash entries during node validation. The %d is the zero-based index of the failing stash in the node's Stashes list; the wrapped %w is the underlying validation error from stash.Validate(). It lets the developer locate which stash entry in the node definition is invalid.

Source

Thrown at pkg/parser/node.go:97

	if n.Filter != "" && n.RunTimeFilter == nil {
		return fmt.Errorf("non-empty filter %q was not compiled", n.Filter)
	}

	if n.RuntimeGrok.RunTimeRegexp != nil || n.Grok.TargetField != "" {
		if err := n.Grok.Validate(); err != nil {
			return err
		}
	}

	for idx, static := range n.Statics {
		if err := static.Validate(ectx); err != nil {
			return fmt.Errorf("static %d: %w", idx, err)
		}
	}

	for idx, stash := range n.Stashes {
		if err := stash.Validate(); err != nil {
			return fmt.Errorf("stash %d: %w", idx, err)
		}
	}

	return nil
}

func (n *Node) processFilter(cachedExprEnv map[string]any) (bool, error) {
	clog := n.Logger
	if n.RunTimeFilter == nil {
		clog.Trace("Node has no filter, enter")
		return true, nil
	}

	// Evaluate node's filter
	output, err := exprhelpers.Run(n.RunTimeFilter, cachedExprEnv, clog, n.Debug)
	if err != nil {
		clog.Warningf("failed to run filter: %v", err)
		clog.Debug("Event leaving node: ko")

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error to identify the failing field of the stash at the given index
2. Open the parser YAML for the node and fix the stash entry at that index
3. Re-run `cscli hubtool` / parser tests (TestParserConfigs) to confirm the config validates

Example fix

# before (invalid stash)
stash:
  - name: my_stash
    expressions:
      - evt.Parsed.foo
# after (expression needs target form)
stash:
  - name: my_stash
    expressions:
      - evt.Parsed.foo == 'bar'

for i, stash := range node.Stashes {
    if err := stash.Validate(); err != nil {
        return fmt.Errorf("stash %d (%s): %w", i, stash.Name, err)
    }
}

func stashIsValid(s Stash) bool { return s.Name != "" && len(s.Expressions) > 0 }

if err := node.validate(); err != nil {
    var cfgErr *ConfigError
    if errors.As(err, &cfgErr) { /* fix parser YAML at reported stash index */ }
    return err
}

When it happens

Trigger: Calling node.validate() (via compile or TestParserConfigs) when a node in a parser YAML has a stash (name/expressions entry) that fails its own Validate() check — e.g. a stash with missing or malformed fields.

Common situations: Hub parser configs with malformed 'stash' entries, hand-edited or user-local parser files with incomplete stash definitions, or new stash schema fields not satisfied by an older parser format.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• cannot parse VictoriaLogs acquisition configuration: %s
• %s: %w
• error in %s: %w
• onsuccess %q not continue,next_stage
• error decoding parsing configuration file '%s': %v

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/193b0f27f0d63758. Report an issue: GitHub.