What causes "while running expression %s: %w" in crowdsecurity/crowdsec?

Log/inspect the event environment (env map) to confirm the fields the expression accesses exist at runtime

while running expression %s: %w

Error message

while running expression %s: %w

What it means

RunExpression evaluates an expr-lang expression against a runtime environment. When expr.Run fails at runtime (after successful compilation), the error is wrapped with the full expression text and both are logged as warnings. It indicates a runtime evaluation problem: missing map key, wrong type in a function call, or a panic recovered by expr.

Source

Thrown at pkg/hubtest/parser_assert.go:193

	// wrap with basename() in case of datasource_path, for backward compatibility
	expression = basenameShim(expression)

	runtimeFilter, err := expr.Compile(expression, opts...)
	if err != nil {
		logger.Errorf("failed to compile '%s': %s", expression, err)
		return output, err
	}

	// dump opcode in trace level
	logger.Tracef("%s", runtimeFilter.Disassemble())

	output, err = expr.Run(runtimeFilter, env)
	if err != nil {
		logger.Warningf("running : %s", expression)
		logger.Warningf("runtime error: %s", err)

		return output, fmt.Errorf("while running expression %s: %w", expression, err)
	}

	return output, nil
}

func (p *ParserAssert) EvalExpression(expression string) (string, error) {
	output, err := p.RunExpression(expression)
	if err != nil {
		return "", err
	}

	ret, err := yaml.Marshal(output)
	if err != nil {
		return "", err
	}

	return string(ret), nil
}

View on GitHub (pinned to 909b515798)

Solutions

Log/inspect the event environment (env map) to confirm the fields the expression accesses exist at runtime
Test the expression in the cscli hubtest interactive console to reproduce the runtime error
Guard expression accesses with optional checks or defaults (e.g. evt.Parsed.field ?? '')
Fix the helper function usage signature (types/arg counts)

Example fix

// before
evt.Parsed.fts_query
// after
evt.Parsed.get('fts_query', '')

Defensive patterns

Strategy: try-catch

Validate before calling

// compile-check the expression before running against live env
if _, err := expr.Compile(expression, expr.Env(envMap)); err != nil {
    return fmt.Errorf("invalid expression: %w", err)
}

Try / catch

out, err := p.RunExpression(expression)
if err != nil {
    log.Errorf("expression %q failed at runtime: %v", expression, errors.Unwrap(err))
    return out, err
}

Prevention

Dump the event map (evt.Parsed/evt.Enriched) to confirm field availability
Use map .get() style access with defaults for optional fields
Validate expressions in the cscli hubtest console first
Pin and test against the expr-lang version crowdsec uses

When it happens

Trigger: EvalExpression or Run invoking RunExpression with an expression referencing fields/functions that error during evaluation against the given env map (nil values, wrong argument types to helper functions like GetWarning(), unavailable runtime fields).

Common situations: Assertions or filter expressions run against events that lack expected fields; helper functions called with wrong types; expressions reused across parser versions where the evt structure changed.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0c255e58bf8bdca8. Report an issue: GitHub.