crowdsecurity/crowdsec · error

unable to compile filter %s : %w

Error message

unable to compile filter %s : %w

What it means

Hook.Build compiles the hook's `filter` expression with the go-expr compiler, using the AppSec expression environment and optional patcher. If the expression has syntax errors or references unknown identifiers/functions, compilation fails and the whole hook cannot be built. This is a configuration-time error: an AppSec rule/hook with an invalid expr filter expression.

Source

Thrown at pkg/appsec/appsec.go:163

		env = GetPreEvalEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})
	case hookPostEval:
		env = GetPostEvalEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})
	case hookOnMatch:
		env = GetOnMatchEnv(&AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{}, pipeline.Event{})
	case hookOnChallenge:
		env = GetOnChallengeEnv(ctx, &AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})
	case hookOnChallengeSubmit:
		env = GetOnChallengeSubmitEnv(&AppsecRuntimeConfig{}, placeholderState, &ParsedRequest{})
	}

	opts := exprhelpers.GetExprOptions(env)
	if patcher != nil {
		opts = append(opts, expr.Patch(patcher))
	}
	if h.Filter != "" {
		program, err := expr.Compile(h.Filter, opts...) // FIXME: opts
		if err != nil {
			return fmt.Errorf("unable to compile filter %s : %w", h.Filter, err)
		}

		h.FilterExpr = program
	}

	for _, apply := range h.Apply {
		program, err := expr.Compile(apply, opts...)
		if err != nil {
			return fmt.Errorf("unable to compile apply %s : %w", apply, err)
		}

		h.ApplyExpr = append(h.ApplyExpr, program)
	}

	return nil
}

type AppsecTempResponse struct {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped expr compiler error — it names the exact syntax position or unknown identifier
2. Test the expression against the AppSec expression environment (see AppsecRules expr helpers docs) with a sample request
3. Fix the filter expression in the YAML appsec-config file
4. Reduce the expression to smaller sub-expressions to isolate which part fails to compile

Example fix

// before (yaml)
filter: "tx.req_contains('bad')"
// after
filter: "contains(tx.path, 'bad')"

When it happens

Trigger: Calling Hook.Build with h.Filter set to an expression that fails expr.Compile — syntax errors, unknown variables not in the AppSec variable map, or wrong argument count to expr functions.

Common situations: Typo in a variable name in an appsec-config rule (e.g. 'tx.foo' vs 'vars.foo'); using functions not registered in the AppSec expr helpers; copy-pasted expression from another CrowdSec component with a different expr environment; unbalanced parentheses.

Related errors

• unable to compile apply %s : %w
• unable to run appsec %s filter %s : %w
• error compiling the scope filter: %w
• compilation of %q failed: %v
• stash %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/00f39a66302abc78. Report an issue: GitHub.