crowdsecurity/crowdsec · error

while compiling stash value expression: %w

Error message

while compiling stash value expression: %w

What it means

Stash.Compile() compiles the `value` expression with the expr library against a pipeline.Event environment. If the expression is syntactically invalid or references unknown fields/functions, compilation fails and the error is wrapped so the stash cannot be instantiated.

Source

Thrown at pkg/parser/stash.go:70

	}

	// should be configurable
	if s.MaxMapSize == 0 {
		s.MaxMapSize = 100
	}

	return nil
}

func (s *Stash) Compile(logger *log.Entry) (*RuntimeStash, error) {
	var err error

	rs := &RuntimeStash{Config: s}

	rs.ValueExpression, err = expr.Compile(s.Value,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash value expression: %w", err)
	}

	rs.KeyExpression, err = expr.Compile(s.Key,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash key expression: %w", err)
	}

	rs.TTLVal, err = time.ParseDuration(s.TTL)
	if err != nil {
		return nil, fmt.Errorf("while parsing stash ttl: %w", err)
	}

	// init the cache, does it make sense to create it here just to be sure everything is fine ?

	cacheCfg := cache.CacheCfg{
		Size:     s.MaxMapSize,
		TTL:      rs.TTLVal,

View on GitHub (pinned to 909b515798)

Solutions

1. Read the underlying expr error after 'while compiling stash value expression:' to locate the syntax/identifier problem.
2. Test the expression with `cscli hubtool` / expr debugging against a real event to confirm fields exist.
3. Fix the value expression in the stash config and reload.

Example fix

// before
value: evt.Parsed.src-address
// after
value: evt.Parsed.source_ip

if _, err := expr.Compile(s.Value, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...); err != nil {
    return fmt.Errorf("stash %q value expr invalid: %w", s.Name, err)
}

rs, err := stash.Compile()
if err != nil {
    if strings.Contains(err.Error(), "stash value expression") { /* fix value: expr */ }
    return err
}

When it happens

Trigger: Calling Compile on a validated Stash whose `Value` string is not a valid expr program (syntax error, unknown identifier, wrong types) — happens during parser startup when loading stash configs.

Common situations: Typos in expr syntax (`evt.Parsed.src-ip`), referencing fields that don't exist on evt, using a helper function not registered in exprhelpers.

Related errors

• stash %s: %w
• while compiling stash key expression: %w
• compilation of %q failed: %v
• compiling static expression %q: %w
• unable to compile filter %s : %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8576284c3b1b8c16. Report an issue: GitHub.