crowdsecurity/crowdsec · error

unexpected type %t (%v) while running '%s'

Error message

unexpected type %t (%v) while running '%s'

What it means

exprhelpers.Run is expected to return a bool for profile filters. If the filter expression evaluates to a non-boolean type (string, int, nil, etc.), EvaluateProfile hits the default switch case and returns this error naming the offending type and expression. It indicates the profile filter does not produce a boolean result.

Source

Thrown at pkg/csprofiles/csprofiles.go:204

			if out {
				matched = true
				/*the expression matched, create the associated decision*/
				subdecisions, err := profile.GenerateDecisionFromProfile(alert)
				if err != nil {
					return nil, matched, fmt.Errorf("while generating decision from profile %s: %w", profile.Cfg.Name, err)
				}

				decisions = append(decisions, subdecisions...)
			} else {
				profile.Logger.Debugf("Profile %s filter is unsuccessful", profile.Cfg.Name)

				if profile.Cfg.OnFailure == "break" {
					break
				}
			}

		default:
			return nil, matched, fmt.Errorf("unexpected type %t (%v) while running '%s'", output, output, profile.Cfg.Filters[eIdx])
		}
	}

	return decisions, matched, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Make the filter's final expression a boolean comparison (==, !=, in, matches, etc.).
2. If it returns a string, wrap it: `Alert.GetEventString('x') == 'expected'`.
3. Test the expression returns true/false in an expr sandbox against an Alert.
4. Check for missing comparison caused by YAML quote stripping.

Example fix

// before
filter: Alert.Remediation
// after
filter: "Alert.Remediation == true"

// ensure the filter is a boolean expression
out, err := expr.Eval(filter, env)
if err != nil {
    return err
}
if _, ok := out.(bool); !ok {
    return fmt.Errorf("filter %q must evaluate to bool, got %T", filter, out)
}

func isBool(v interface{}) bool { _, ok := v.(bool); return ok }

decisions, matched, err := profile.EvaluateProfile(alert)
if err != nil && strings.Contains(err.Error(), "unexpected type") {
    log.Warnf("non-bool filter, skipping profile: %v", err)
    return
}

When it happens

Trigger: A profile filter expression whose last evaluated value is not bool: e.g. `filter: Alert.Remediation` returning nil, `filter: Alert.GetEventString('x')` returning a string, or a numeric/arithmetic expression without a comparison.

Common situations: Hand-written filters omitting a comparison operator; copying a parser/whitelist expression that returns a string into a profile filter; YAML quoting making what looks like a bool a string.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• AverageInterval expects a slice of times
• groupby wrong type
• error compiling duration_expr of %s: %w
• while running expression %s: %w
• invalid type for ip : %T

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a8b952134fb9ac38. Report an issue: GitHub.