crowdsecurity/crowdsec · error

static %d: %w

Error message

static %d: %w

What it means

During node validation each static entry is checked via static.Validate; a failing static is wrapped with its index ('static %d') so the offending entry in the node's statics list can be identified. The inner error (from static.Validate) describes the actual problem, such as an invalid value expression.

Source

Thrown at pkg/parser/node.go:91

	/* "" behaves like continue */
	if n.OnSuccess != "continue" && n.OnSuccess != "next_stage" && n.OnSuccess != "" {
		return fmt.Errorf("onsuccess %q not continue,next_stage", n.OnSuccess)
	}

	if n.Filter != "" && n.RunTimeFilter == nil {
		return fmt.Errorf("non-empty filter %q was not compiled", n.Filter)
	}

	if n.RuntimeGrok.RunTimeRegexp != nil || n.Grok.TargetField != "" {
		if err := n.Grok.Validate(); err != nil {
			return err
		}
	}

	for idx, static := range n.Statics {
		if err := static.Validate(ectx); err != nil {
			return fmt.Errorf("static %d: %w", idx, err)
		}
	}

	for idx, stash := range n.Stashes {
		if err := stash.Validate(); err != nil {
			return fmt.Errorf("stash %d: %w", idx, err)
		}
	}

	return nil
}

func (n *Node) processFilter(cachedExprEnv map[string]any) (bool, error) {
	clog := n.Logger
	if n.RunTimeFilter == nil {
		clog.Trace("Node has no filter, enter")
		return true, nil
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Look at the wrapped inner error and the reported index to find the offending statics entry in the parser YAML.
2. Fix the static's value: either a literal or a valid expr expression using known evt fields and helpers.
3. Test the parser config with `cscli hub test` to confirm the static evaluates correctly.
4. Update or reinstall the hub collection if its statics are broken/outdated.

Example fix

// before (parser yaml)
statics:
  - meta: log_type
    value: evt.Parsed['type' ==
// after
statics:
  - meta: log_type
    value: evt.Parsed.type

for idx, s := range node.Statics {
    if err := s.Validate(ectx); err != nil {
        return fmt.Errorf("static %d invalid before load: %w", idx, err)
    }
}

if err := node.Validate(ectx); err != nil {
    if strings.Contains(err.Error(), "static ") {
        var idx int
        fmt.Sscanf(err.Error(), "static %d", &idx)
        logger.Errorf("check statics entry #%d in the parser config: %v", idx, err)
    }
    return err
}

When it happens

Trigger: validate() iterates n.Statics and calls static.Validate(ectx); any error from a static — e.g. a static with a bad 'value' expr or a invalid target field — gets index-wrapped by this line.

Common situations: Custom parser statics block with a malformed expression in 'value'; a static referencing an expr helper that doesn't exist; hub collection statics incompatible with the current crowdsec version.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• onsuccess %q not continue,next_stage
• non-empty filter %q was not compiled
• path must start with /
• invalid filter
• no parser found. Please install the appropriate parser and r

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/449dd2ffd5fd622a. Report an issue: GitHub.