{"record":{"id":"6420d1edd4b53051","repo":"crowdsecurity/crowdsec","slug":"labels-not-a-map","errorCode":null,"errorMessage":"labels not a map","messagePattern":"labels not a map","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/docker/source.go","lineNumber":108,"sourceCode":"\tif !ok {\n\t\td.logger.Errorf(\"%s has 'crowdsec.enable' label set but it's not a string\", entityType)\n\t\treturn nil, errors.New(\"crowdsec.enable not a string\")\n\t}\n\n\tif strings.ToLower(enable) != \"true\" {\n\t\td.logger.Debugf(\"%s has 'crowdsec.enable' label not set to true ignoring %s: %s\", entityType, entityType, entityID)\n\t\treturn nil, errors.New(\"crowdsec.enable not true\")\n\t}\n\n\tif _, ok = parsedLabels[\"labels\"]; !ok {\n\t\td.logger.Errorf(\"%s has 'crowdsec.enable' label set to true but no 'labels' keys found\", entityType)\n\t\treturn nil, errors.New(\"no labels key\")\n\t}\n\n\tlabelsTypeCast, ok := parsedLabels[\"labels\"].(map[string]any)\n\tif !ok {\n\t\td.logger.Errorf(\"%s has 'crowdsec.enable' label set to true but 'labels' is not a map\", entityType)\n\t\treturn nil, errors.New(\"labels not a map\")\n\t}\n\n\td.logger.Debugf(\"%s labels %+v\", entityType, labelsTypeCast)\n\n\tlabels := make(map[string]string)\n\n\tfor k, v := range labelsTypeCast {\n\t\tif v, ok := v.(string); ok {\n\t\t\tlog.Debugf(\"label %s is a string with value %s\", k, v)\n\t\t\tlabels[k] = v\n\t\t\tcontinue\n\t\t}\n\n\t\td.logger.Errorf(\"label %s is not a string\", k)\n\t}\n\n\treturn labels, nil\n}","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/docker/source.go#L90-L126","documentation":"After enabling, the 'labels' entry must be a map[string]any of label key/values to attach to events; the assertion parsedLabels[\"labels\"].(map[string]any) failed, so the entity is rejected. This protects the source from malformed or flat label structures.","triggerScenarios":"processCrowdsecLabels (via EvalContainer/EvalService) receives parsedLabels[\"labels\"] as a non-map value — e.g. a string like crowdsec.labels=syslog, a list, or a bool — instead of a map of key/value pairs.","commonSituations":"User wrote crowdsec.labels as a single flat label with a scalar value instead of per-key labels (crowdsec.labels.type=...); a list under labels in YAML; tooling that flattens nested labels into one string.","solutions":["Express labels as key/value pairs under crowdsec.labels, e.g. crowdsec.labels.type=syslog and crowdsec.labels.program=ssh","Never assign a scalar to crowdsec.labels itself — it must be a map","If using compose, structure it as labels: { crowdsec: { enable: 'true', labels: { type: syslog } } } and verify nesting","Dump the effective labels with 'docker inspect --format \"{{json .Config.Labels}}\"' to confirm the structure"],"exampleFix":"# before (scalar where a map is required)\nlabels:\n  - crowdsec.enable=true\n  - crowdsec.labels=syslog\n# after (map of label key/values)\nlabels:\n  - crowdsec.enable=true\n  - crowdsec.labels.type=syslog\n  - crowdsec.labels.program=sshd","handlingStrategy":"type-guard","validationCode":"if strings.EqualFold(labels[\"crowdsec.enable\"], \"true\") {\n\tfor k, v := range labels {\n\t\tif strings.HasPrefix(k, \"crowdsec.labels.\") {\n\t\t\t_ = k + v // flat per-key labels are fine; a scalar crowdsec.labels is not\n\t\t}\n\t}\n}","typeGuard":"func labelsIsMap(v any) bool {\n\t_, ok := v.(map[string]any)\n\treturn ok\n}","tryCatchPattern":"if _, err := source.EvalContainer(ctx, ctr); err != nil {\n\tif err.Error() == \"labels not a map\" {\n\t\tlog.Errorf(\"container %s: crowdsec.labels must be key/value pairs, not a scalar\", ctr.ID)\n\t}\n}","preventionTips":["Never give crowdsec.labels a scalar value; use crowdsec.labels.<key>=<value> entries","Inspect effective labels with docker inspect to confirm structure before debugging","Keep compose label nesting explicit and lint for maps under crowdsec.labels"],"tags":["docker","labels","type-mismatch"],"backgroundTag":"config-type-mismatch","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}