What causes "while parsing stash ttl: %w" in crowdsecurity/crowdsec?

Use Go duration syntax for the stash ttl: "1h", "30m" — days are not supported, express them in hours

while parsing stash ttl: %w

Error message

while parsing stash ttl: %w

What it means

RuntimeStash.Compile parses the stash configuration's 'ttl' with time.ParseDuration; an invalid duration string in the parser's stash configuration (e.g. '10' without a unit) makes compilation fail at parser load time.

Source

Thrown at pkg/parser/stash.go:81

	var err error

	rs := &RuntimeStash{Config: s}

	rs.ValueExpression, err = expr.Compile(s.Value,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash value expression: %w", err)
	}

	rs.KeyExpression, err = expr.Compile(s.Key,
		exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
	if err != nil {
		return nil, fmt.Errorf("while compiling stash key expression: %w", err)
	}

	rs.TTLVal, err = time.ParseDuration(s.TTL)
	if err != nil {
		return nil, fmt.Errorf("while parsing stash ttl: %w", err)
	}

	// init the cache, does it make sense to create it here just to be sure everything is fine ?

	cacheCfg := cache.CacheCfg{
		Size:     s.MaxMapSize,
		TTL:      rs.TTLVal,
		Name:     s.Name,
		Strategy: s.Strategy,
		LogLevel: logger.Logger.GetLevel(),
	}

	if err = cache.CacheInit(cacheCfg, cacheCfg.NewLogger()); err != nil {
		return nil, fmt.Errorf("while initializing cache: %w", err)
	}

	return rs, nil
}

View on GitHub (pinned to 909b515798)

Solutions

Use Go duration syntax for the stash ttl: "1h", "30m" — days are not supported, express them in hours
Omit the ttl directive if the stash should not expire

Example fix

// before
ttl: 1d
// after
ttl: 24h

Defensive patterns

Strategy: validation

Validate before calling

if _, err := time.ParseDuration(s.TTL); err != nil {
    return fmt.Errorf("stash %q ttl %q is not a Go duration: %w", s.Name, s.TTL, err)
}

Try / catch

if _, err := time.ParseDuration(ttlStr); err != nil {
    return fmt.Errorf("bad ttl %q: use units s/m/h (no 'd')", ttlStr)
}

Prevention

Use only Go duration units: ns, us, ms, s, m, h — never 'd'.
Always give a unit (3600 alone is invalid; write 1h).

When it happens

Trigger: A stash `ttl:` value like "1 hour", "3600", "1d", or an empty-but-non-validated string is passed to time.ParseDuration during Compile.

Common situations: Users writing human-friendly durations ("1 day", "one hour"), plain numbers without units, or day units ("1d") which Go durations don't support.

Understand the failure class

Background: "invalid duration" / "failed to parse duration": why your timeout, interval, or TTL string is rejected and which formats each library accepts — this error's family across 32 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fa64b63f4a8607a2. Report an issue: GitHub.