crowdsecurity/crowdsec · error

while running scope filter: %w

Error message

while running scope filter: %w

What it means

In crowdsec's leakybucket package, eventSources builds the source scope(s) of an event for a bucket whose ScopeType is types.Range. When a runtime scope filter expression is defined, it is evaluated via exprhelpers.Run against the event; if the expr-lang expression errors at evaluation time, the function aborts and wraps the underlying expression error in this message. It signals a scope filter from the parser/bucket config that failed at runtime, not a bucket-processing failure.

Source

Thrown at pkg/leakybucket/overflows.go:175

			if err != nil {
				return srcs, fmt.Errorf("declared range %s of %s can't be parsed", v, src.IP)
			}

			if ipNet != nil {
				src.Range = ipNet.String()
				leaky.logger.Tracef("Valid range from %s : %s", src.IP, src.Range)
			}
		}

		if leaky.Factory.Spec.ScopeType.Scope == types.Ip {
			src.Value = &src.IP
		} else if leaky.Factory.Spec.ScopeType.Scope == types.Range {
			src.Value = &src.Range

			if leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {
				retValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{"evt": &evt}, leaky.logger, leaky.Factory.Spec.Debug)
				if err != nil {
					return srcs, fmt.Errorf("while running scope filter: %w", err)
				}

				value, ok := retValue.(string)
				if !ok {
					value = ""
				}

				src.Value = &value
			}
		}

		srcs[*src.Value] = src
	default:
		if leaky.Factory.Spec.ScopeType.RunTimeFilter == nil {
			return srcs, errors.New("empty scope information")
		}

		retValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{"evt": &evt}, leaky.logger, leaky.Factory.Spec.Debug)

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped underlying expr error in the message to identify the failing expression element
2. Print the event (evt.Parsed/evt.Enriched) for a failing case and check every field the scope filter references exists and has the expected type
3. Fix the scope_filter expression in the scenario/profile YAML (or remove it to fall back to the static Scope)
4. Test the corrected expression with cscli / csctl hub or by replaying the offending log line through the parser

Example fix

// before (scenario yaml)
scope:
  type: range
  filter: evt.Parsed.clientip
// after
scope:
  type: range
  filter: evt.Parsed.source_ip

// Before relying on the scenario, test the scope filter against representative parsed events:
// crowdsec -type <type> -config ... with debug on the bucket, or replay the log line and
// confirm evt.Parsed contains every field the filter references:
// grep 'scope' /var/log/crowdsec.log after enabling debug: true on the scenario

// In the expression, tolerate missing fields:
// Get(evt.Parsed, 'client_ip', '') != ''

When it happens

Trigger: A bucket profile/scenario with ScopeType Scope==Range has ScopeType.RunTimeFilter set, and exprhelpers.Run on {"evt": &evt} returns an error — e.g. the expression references a field absent from evt.Parsed, uses a wrong type (arithmetic on a string field), or calls an unknown expr function.

Common situations: Custom scenarios with a hand-written scope_filter like evt.Parsed.client_ip that doesn't exist for this parser output; a parser change removing/renaming a field the filter relies on; upgrading crowdsec and an expr built-in used in the filter changed behavior.

Related errors

• leaky failed :/
• error compiling the scope filter: %w
• AverageInterval expects exactly one parameter: a slice of ti
• AverageInterval expects a slice of times
• need at least two times to calculate an average interval

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b34debca10599dc4. Report an issue: GitHub.