{"record":{"id":"62e42f352be5fe7a","repo":"crowdsecurity/crowdsec","slug":"journalctl-filter-is-required","errorCode":null,"errorMessage":"journalctl_filter is required","messagePattern":"journalctl_filter is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/config.go","lineNumber":48,"sourceCode":"\n\tcfg.SetDefaults()\n\n\tif err := cfg.Validate(); err != nil {\n\t\treturn cfg, err\n\t}\n\n\treturn cfg, nil\n}\n\nfunc (c *Configuration) SetDefaults() {\n\tif c.Mode == \"\" {\n\t\tc.Mode = configuration.TAIL_MODE\n\t}\n}\n\nfunc (c *Configuration) Validate() error {\n\tif len(c.Filters) == 0 {\n\t\treturn errors.New(\"journalctl_filter is required\")\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\tcfg, err := ConfigurationFromYAML(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.config = cfg\n\n\ts.setSrc(s.config.Filters)\n\n\treturn nil\n}\n","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/config.go#L30-L66","documentation":"The journalctl acquisition source requires at least one journalctl filter (e.g. a unit) to know which journal entries to read. Validate() (pkg/acquisition/modules/journalctl/config.go:48) rejects a Configuration with an empty Filters list.","triggerScenarios":"Starting a journalctl source whose config has no journal_filter entries — e.g. an empty acquis.yaml entry `source: journalctl` with no filters, or ConfigureByDSN called without a filters query parameter.","commonSituations":"Forgetting the journal_filter key in the YAML; YAML indentation mistake that silently drops the list; building the DSN programmatically and omitting the filters param.","solutions":["Add a journal_filter list to the config, e.g. journal_filter: [ _SYSTEMD_UNIT=ssh.service ].","If using a DSN, append the filters parameter: journalctl://?filters=_SYSTEMD_UNIT=ssh.service.","Check YAML indentation so the filter list actually parses into journal_filter."],"exampleFix":"// before (acquis.yaml)\nsource: journalctl\n\n// after\nsource: journalctl\njournal_filter:\n  - _SYSTEMD_UNIT=ssh.service","handlingStrategy":"validation","validationCode":"if len(cfg.Filters) == 0 {\n    return errors.New(\"journalctl source requires at least one journal_filter entry\")\n}","typeGuard":"func hasJournalFilters(cfg map[string]any) bool {\n    f, ok := cfg[\"journal_filter\"].([]any)\n    return ok && len(f) > 0\n}","tryCatchPattern":"if err := src.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"journalctl_filter is required\") {\n        // add journal_filter to acquis.yaml and retry\n    }\n}","preventionTips":["Always pair `source: journalctl` with a journal_filter list in acquis.yaml.","Check YAML indentation so lists parse as arrays, not strings.","Include a filters param when constructing journalctl:// DSNs."],"tags":["config","validation","journalctl"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}