{"record":{"id":"137068933df58844","repo":"crowdsecurity/crowdsec","slug":"empty-scope-information","errorCode":null,"errorMessage":"empty scope information","messagePattern":"empty scope information","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":190,"sourceCode":"\t\t\tif leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {\n\t\t\t\tretValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{\"evt\": &evt}, leaky.logger, leaky.Factory.Spec.Debug)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn srcs, fmt.Errorf(\"while running scope filter: %w\", err)\n\t\t\t\t}\n\n\t\t\t\tvalue, ok := retValue.(string)\n\t\t\t\tif !ok {\n\t\t\t\t\tvalue = \"\"\n\t\t\t\t}\n\n\t\t\t\tsrc.Value = &value\n\t\t\t}\n\t\t}\n\n\t\tsrcs[*src.Value] = src\n\tdefault:\n\t\tif leaky.Factory.Spec.ScopeType.RunTimeFilter == nil {\n\t\t\treturn srcs, errors.New(\"empty scope information\")\n\t\t}\n\n\t\tretValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{\"evt\": &evt}, leaky.logger, leaky.Factory.Spec.Debug)\n\t\tif err != nil {\n\t\t\treturn srcs, fmt.Errorf(\"while running scope filter: %w\", err)\n\t\t}\n\n\t\tvalue, ok := retValue.(string)\n\t\tif !ok {\n\t\t\tvalue = \"\"\n\t\t}\n\n\t\tsrc.Value = &value\n\t\tsrc.Scope = new(string)\n\t\t*src.Scope = leaky.Factory.Spec.ScopeType.Scope\n\t\tsrcs[*src.Value] = src\n\t}\n","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L172-L208","documentation":"When building alert sources, if the bucket's ScopeType has no runtime filter and the event doesn't match earlier source branches, eventSources cannot determine what the alert is 'about' and returns this error. Every overflow needs a scope (IP, range, etc.) to attribute the alert.","triggerScenarios":"An event overflows a bucket whose scope_types / ScopeType.RunTimeFilter is nil (missing or misconfigured scope in the scenario), so no source can be derived.","commonSituations":"Custom scenarios missing `scope:`/scope filter directives, or scope expressions failing to compile so RunTimeFilter stays nil.","solutions":["Add a `scope:` entry (e.g. type: ip, expression: evt.Meta.source_ip) to the scenario","Fix the scope expression so it compiles into a runtime filter","Check that the scope type name is one supported by crowdsec (ip, range, email, username, ...)"],"exampleFix":"# before\nname: x/no-scope\ntype: leaky\nfilter: \"...\"\n# after\nname: x/no-scope\ntype: leaky\nscope:\n  type: ip\n  expression: evt.Meta.source_ip\nfilter: \"...\"","handlingStrategy":"validation","validationCode":"if bucket.Spec.ScopeTypes == nil || len(bucket.Spec.ScopeTypes) == 0 {\n    return errors.New(\"scenario must define at least one scope with a valid expression\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Every scenario declares scope: with a resolvable expression","Confirm scope expressions compile (bad ones leave RunTimeFilter nil)","Use standard scope types: ip, range, username"],"tags":["crowdsec","leakybucket","scope","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}