{"record":{"id":"8fc29cde5c6ca965","repo":"crowdsecurity/crowdsec","slug":"missing-filter-directive","errorCode":null,"errorMessage":"missing filter directive","messagePattern":"missing filter directive","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/manager_load.go","lineNumber":247,"sourceCode":"\t\t}\n\t\tf.leakspeed = leakspeed\n\t}\n\n\tif f.Spec.Duration != \"\" {\n\t\tduration, err := time.ParseDuration(f.Spec.Duration)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid duration '%s' in %s: %w\", f.Spec.Duration, f.Filename, err)\n\t\t}\n\t\tf.duration = duration\n\t}\n\n\treturn nil\n}\n\nfunc (f *BucketFactory) compileExpr() error {\n\tif f.Spec.Filter == \"\" {\n\t\tf.logger.Warning(\"Bucket without filter, abort.\")\n\t\treturn errors.New(\"missing filter directive\")\n\t}\n\n\truntimeFilter, err := compile(f.Spec.Filter, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid filter '%s' in %s: %w\", f.Spec.Filter, f.Filename, err)\n\t}\n\tf.RunTimeFilter = runtimeFilter\n\n\tif f.Spec.GroupBy != \"\" {\n\t\truntimeGroupBy, err := compile(f.Spec.GroupBy, nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid groupby '%s' in %s: %w\", f.Spec.GroupBy, f.Filename, err)\n\t\t}\n\t\tf.RunTimeGroupBy = runtimeGroupBy\n\t}\n\n\treturn nil\n}","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/manager_load.go#L229-L265","documentation":"Validation failure in BucketFactory.compileExpr (reached via LoadBucket): the scenario specification has an empty filter directive, so there is no expression to evaluate for pouring events into the bucket. A warning 'Bucket without filter, abort.' is logged before returning.","triggerScenarios":"Loading a bucket whose Spec.Filter is the empty string (missing `filter:` in YAML), during LoadBucket.","commonSituations":"Scenario YAML missing the filter key, template variables resolving to empty strings, or copying a bucket skeleton with the filter removed.","solutions":["Add a valid `filter:` expr expression to the bucket spec","Verify templating renders a non-empty filter","If you truly want an always-match bucket, use a filter that evaluates to true, e.g. `filter: \"evt.Meta.log_type != ''\"`"],"exampleFix":"# before\nname: x/empty\ntype: leaky\ndescription: foo\n# after\nname: x/empty\ntype: leaky\ndescription: foo\nfilter: \"evt.Meta.log_type == 'http_access-log'\"","handlingStrategy":"validation","validationCode":"if bucket.Spec.Filter == \"\" {\n    return errors.New(\"scenario requires a non-empty filter expression\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never remove filter from a scenario skeleton","If templated, verify the rendered output still contains a filter","Test expression with cscli hubtest"],"tags":["crowdsec","leakybucket","config-validation","expr"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}