What causes "while compiling stash key expression: %w" in crowdsecurity/crowdsec?

Fix the stash key expression in the parser configuration — check expr syntax and available evt fields

while compiling stash key expression: %w

Error message

while compiling stash key expression: %w

What it means

Compiling the stash entry's Key expr expression failed. The stash (parser key/value store) requires both Key and Value to be valid expr code evaluated against an evt of type pipeline.Event; a syntax error or unknown identifier in the key expression lands here.

Source

Thrown at pkg/parser/stash.go:76

	return nil
}

func (s *Stash) Compile(logger *log.Entry) (*RuntimeStash, error) {
	var err error

	rs := &RuntimeStash{Config: s}

	rs.ValueExpression, err = expr.Compile(s.Value,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash value expression: %w", err)
	}

	rs.KeyExpression, err = expr.Compile(s.Key,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash key expression: %w", err)
	}

	rs.TTLVal, err = time.ParseDuration(s.TTL)
	if err != nil {
		return nil, fmt.Errorf("while parsing stash ttl: %w", err)
	}

	// init the cache, does it make sense to create it here just to be sure everything is fine ?

	cacheCfg := cache.CacheCfg{
		Size:     s.MaxMapSize,
		TTL:      rs.TTLVal,
		Name:     s.Name,
		Strategy: s.Strategy,
		LogLevel: logger.Logger.GetLevel(),
	}

	if err = cache.CacheInit(cacheCfg, cacheCfg.NewLogger()); err != nil {

View on GitHub (pinned to 909b515798)

Solutions

Fix the stash key expression in the parser configuration — check expr syntax and available evt fields
If referencing helper functions, verify they exist (exprhelpers) in the installed version

Example fix

// before
key: evt.Parsed.ip +
// after
key: evt.Parsed.source_ip

Defensive patterns

Strategy: validation

Validate before calling

if _, err := expr.Compile(s.Key, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...); err != nil {
    return fmt.Errorf("stash %q key expr invalid: %w", s.Name, err)
}

Try / catch

rs, err := stash.Compile()
if err != nil {
    if strings.Contains(err.Error(), "stash key expression") { /* fix key: expr */ }
    return err
}

Prevention

Prefer simple field references as keys (e.g. evt.Parsed.source_ip).
Validate YAML quoting — long expressions on one line, not folded blocks.

When it happens

Trigger: Compile is called with a Stash whose `Key` string fails expr compilation — syntax error, unknown function, or type mismatch against pipeline.Event.

Common situations: Key expressions using fields absent from the event at stash time, or quoting mistakes in YAML that mangle the expression.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6c5fcaca35a65883. Report an issue: GitHub.