crowdsecurity/crowdsec · error

stash %s: %w

Error message

stash %s: %w

What it means

Wraps an error from compiling one of a node's stash entries during node.compile(). The %s is the stash's Name, and %w is the underlying error from stash.Compile(n.Logger) (typically a failed expr compilation of the stash's expressions). It identifies which named stash failed so the offending parser config can be fixed.

Source

Thrown at pkg/parser/node.go:469

			return err
		}
	}

	if n.Grok.RegexpName != "" || n.Grok.RegexpValue != "" || n.Grok.ExpValue != "" {
		rg, err := n.Grok.Compile(pctx, n.Logger)
		if err != nil {
			return err
		}

		n.RuntimeGrok = *rg
		valid = true
	}

	for _, stash := range n.Stashes {
		compiled, err := stash.Compile(n.Logger)
		if err != nil {
			return fmt.Errorf("stash %s: %w", stash.Name, err)
		}
		n.RuntimeStashes = append(n.RuntimeStashes, *compiled)
	}

	/* compile leafs if present */
	for idx := range n.LeavesNodes {
		if n.LeavesNodes[idx].Name == "" {
			n.LeavesNodes[idx].Name = "child-" + n.Name
		}

		// propagate debug/stats to child nodes
		if !n.LeavesNodes[idx].Debug && n.Debug {
			n.LeavesNodes[idx].Debug = true
		}

		if !n.LeavesNodes[idx].Profiling && n.Profiling {
			n.LeavesNodes[idx].Profiling = true
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error for the exact failing expression inside the named stash
2. Fix or remove the offending expression in the parser YAML stash entry
3. Pin/upgrade CrowdSec so the expr helpers used by the hub config exist
4. Re-run TestParserConfigs or `cscli hubtool` to confirm

Example fix

# before
stash:
  - name: wl
    expressions:
      - Get('foo'
# after (balanced, compilable)
stash:
  - name: wl
    expressions:
      - Get('foo') != nil

for _, stash := range node.Stashes {
    if _, err := stash.Compile(logger); err != nil {
        return fmt.Errorf("stash %q not compilable: %w", stash.Name, err)
    }
}

if err := node.compile(pctx, ectx); err != nil {
    if strings.Contains(err.Error(), "stash ") { /* isolate named stash and fix its expressions */ }
    return err
}

When it happens

Trigger: Calling node.compile() (from processStageFile or TestParserConfigs) when a stash's expressions cannot be compiled by expr — bad syntax, unknown functions, or type errors in the stash expression list.

Common situations: Hub parser updates introducing expressions incompatible with the local CrowdSec/expr version, hand-edited stashes, whitelists/stash expressions referencing non-existent helpers.

Related errors

• while compiling stash value expression: %w
• while compiling stash key expression: %w
• compilation of %q failed: %v
• compiling static expression %q: %w
• unable to compile filter %s : %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cd0d9a0e8bfc3868. Report an issue: GitHub.