Background
When a grouping parenthesis ( is not properly closed in a WPL pipeline, the online editor reports a generic syntax error at a later and unrelated location (typically a closing } of the rule or package block). The error message does not indicate that the real issue is a missing closing parenthesis.
This makes the error difficult to diagnose, especially for new users, as the reported line and column are far away from the actual mistake.
Steps to Reproduce
-
Open the online WPL editor.
-
Use the following rule snippet (note the missing closing parenthesis )):
json | take(log) | json_unescape() | (
ip: sip,
2*_,
time: recv_time<[, ]>,
http/request",
http/status,
digit,
chars",
http/agent",
_
-
Click the “Parse” button.
Actual Result
The editor reports a syntax error at the end of the rule block:
WPL parse failed: [500] syntax error > parse error at line 15, column 1
invalid symbol
expected ,, next field, ( ... ), group '( ... )' content, group, , rule <name> { ... }, { rule ... }
Error Code: WPL_PARSE_ERROR
The error location points to the closing } of the rule/package, which is not the real source of the problem.
Expected Result
The error message should clearly indicate that:
- A closing parenthesis
) is missing
- The error originates from the pipeline grouping that starts earlier in the rule
- The reported location should point to the opening
( or the line where the group begins

For example:
Missing closing parenthesis `)` for group started at line 4.
Please check pipeline group boundaries.
Impact
Users are misled into inspecting the rule or package structure instead of the pipeline content. This significantly increases debugging time and makes the language appear harder to learn than it actually is.
Suggested Improvement
- Track opening parentheses and group boundaries during parsing.
- When the parser reaches the end of a rule or block with unclosed groups, emit a targeted error message indicating:
- The type of missing token (`)
- The line number where the group was opened
- Avoid reporting the error at an unrelated closing brace whenever possible.
Background
When a grouping parenthesis
(is not properly closed in a WPL pipeline, the online editor reports a generic syntax error at a later and unrelated location (typically a closing}of the rule or package block). The error message does not indicate that the real issue is a missing closing parenthesis.This makes the error difficult to diagnose, especially for new users, as the reported line and column are far away from the actual mistake.
Steps to Reproduce
Open the online WPL editor.
Use the following rule snippet (note the missing closing parenthesis
)):json | take(log) | json_unescape() | (
ip: sip,
2*_,
time: recv_time<[, ]>,
http/request",
http/status,
digit,
chars",
http/agent",
_
Click the “Parse” button.
Actual Result
The editor reports a syntax error at the end of the rule block:
WPL parse failed: [500] syntax error > parse error at line 15, column 1
invalid symbol
expected
,, next field,( ... ), group '( ... )' content, group, ,rule <name> { ... },{ rule ... }Error Code: WPL_PARSE_ERROR
The error location points to the closing
}of the rule/package, which is not the real source of the problem.Expected Result
The error message should clearly indicate that:
)is missing(or the line where the group beginsImpact
Users are misled into inspecting the rule or package structure instead of the pipeline content. This significantly increases debugging time and makes the language appear harder to learn than it actually is.
Suggested Improvement