What causes "while compiling regexp '%s': %w" in crowdsecurity/crowdsec?

Fix the regexp syntax in stream_regexp; test it with a Go RE2-compatible checker.

while compiling regexp '%s': %w

Error message

while compiling regexp '%s': %w

What it means

The cloudwatch source compiles stream_regexp up-front with regexp.Compile to fail fast on invalid patterns before querying AWS. A malformed regular expression aborts source configuration with this wrapped error.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:187

		if s.Config.AwsRegion == "" {
			s.logger.Errorf("aws_region is not specified, specify it or aws_config_dir")
			return errors.New("aws_region is not specified, specify it or aws_config_dir")
		}

		os.Setenv("AWS_REGION", s.Config.AwsRegion)
	}

	if err := s.newClient(ctx); err != nil {
		return err
	}

	s.streamIndexes = make(map[string]string)

	targetStream := "*"

	if s.Config.StreamRegexp != nil {
		if _, err := regexp.Compile(*s.Config.StreamRegexp); err != nil {
			return fmt.Errorf("while compiling regexp '%s': %w", *s.Config.StreamRegexp, err)
		}

		targetStream = *s.Config.StreamRegexp
	} else if s.Config.StreamName != nil {
		targetStream = *s.Config.StreamName
	}

	s.logger.Infof("Adding cloudwatch group '%s' (stream:%s) to datasources", s.Config.GroupName, targetStream)

	return nil
}

func (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	s.logger = logger

	dsn = strings.TrimPrefix(dsn, s.GetName()+"://")

	args := strings.Split(dsn, "?")

View on GitHub (pinned to 909b515798)

Solutions

Fix the regexp syntax in stream_regexp; test it with a Go RE2-compatible checker.
Remove lookahead/lookbehind or backreference constructs unsupported by Go regexp.
Check YAML escaping: use single quotes ('\d+') or double the backslash in double-quoted strings.
Pre-validate the pattern with regexp.Compile in a scratch Go program before editing the live config.

Example fix

// before
stream_regexp: "(?=.*prod).*logs"  # lookahead unsupported
// after
stream_regexp: ".*prod.*logs"

Defensive patterns

Strategy: validation

Validate before calling

if cfg.StreamRegexp != nil {
    if _, err := regexp.Compile(*cfg.StreamRegexp); err != nil {
        return fmt.Errorf("invalid stream_regexp: %w", err)
    }
}

Try / catch

if err := src.Configure(ctx, cfg); err != nil {
    if strings.Contains(err.Error(), "compiling regexp") {
        return fmt.Errorf("fix stream_regexp syntax: %w", err)
    }
}

Prevention

Test regexes against Go RE2 (no lookahead/backreferences) before deploying
Quote regexes in YAML with single quotes to avoid backslash escaping issues
Lint acquis.yaml in CI with a compile check

When it happens

Trigger: Configure path (setupAWS) encountering a stream_regexp value that Go's regexp (RE2) cannot compile — e.g. unbalanced parentheses, invalid escape sequences like '\d' being mis-escaped in YAML, or unsupported lookahead constructs.

Common situations: Copying PCRE-style regexes from other tools using unsupported features (lookaheads, backreferences), YAML escaping mangling backslashes ('\d' vs '\\d'), or hand-edited config typos like a missing closing ')'.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/14d9d1b6bcfa29ce. Report an issue: GitHub.