eval_non_boolean

Summary

expected boolean expression

Help

the root expression must produce a boolean. add a comparison like >, ==, is, ...

Details

When this fires

The evaluator was asked to produce a boolean result (typically the root of an alert rule) but the expression yielded a number, string, or array. Alert rules must evaluate to true/false so the engine knows when to fire.

What to check

Add a comparison operator at the root: >, <, ==, is, contains, in, ...

# broken: evaluates to a number
expr = "cpu.usage"
# fixed
expr = "cpu.usage > 90"

Most often this is caught at parse time as non_boolean_root. The eval-time variant fires when the AST shape only becomes non-boolean after a branch is selected.