non_boolean_root

Summary

expression must be boolean

Help

add a comparison operator like >, <, ==, is, contains, ...

Details

When this fires

The parser finished an alert expression and the root node wasn't a boolean. Rule expressions decide when an alert fires, so the top of the AST has to be a comparison or a logical combinator.

What to check

Add a comparison at the root: >, <, ==, is, contains, in, between, ...

# broken: just a value
expr = "cpu.usage * 2"
# fixed
expr = "cpu.usage * 2 > 150"

Caught by nanook check. The runtime sibling is nanook::expr::eval_non_boolean.