{"record":{"id":"90f5709b2d30d9ce","repo":"crowdsecurity/crowdsec","slug":"missing-source-field","errorCode":null,"errorMessage":"missing 'source' field","messagePattern":"missing 'source' field","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/acquisition.go","lineNumber":271,"sourceCode":"\t// report that the user did not specify a source\n\tif sub.Source == \"\" {\n\t\tparsed.SourceMissing = true\n\t}\n\n\t// report that the user specified a source that doesn't match with one detected from the presence of other fields\n\tif detectedType != \"\" {\n\t\tif sub.Source != \"\" && sub.Source != detectedType {\n\t\t\tparsed.SourceOverridden = sub.Source\n\t\t}\n\n\t\tsub.Source = detectedType\n\t}\n\n\tparsed.Common = sub\n\n\t// could not detect, alas\n\tif sub.Source == \"\" {\n\t\treturn nil, errors.New(\"missing 'source' field\")\n\t}\n\n\t// pre-check that the source is valid\n\t_, err = registry.LookupFactory(sub.Source)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// check for labels now, an error for missing labels has lower priority\n\t// than missing or unknown source type\n\tif len(sub.Labels) == 0 && sub.Source != \"docker\" {\n\t\t// docker is the only source that does not require labels\n\t\treturn nil, errors.New(\"missing labels\")\n\t}\n\n\tuniqueID := uuid.NewString()\n\tsub.UniqueId = uniqueID\n","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/acquisition.go#L253-L289","documentation":"Generic guard in ParseSourceConfig: after both explicit declaration and type detection, sub.Source is still empty. The loader tried to infer the datasource type from characteristic keys (filenames, journalctl_filter, etc.) and found none, and the user did not set 'source' — so there is no way to know which acquisition module to instantiate. SourceMissing/SourceOverridden on ParsedSourceConfig record the detection details for the caller.","triggerScenarios":"Thrown at pkg/acquisition/acquisition.go:271 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add an explicit 'source: <type>' key (e.g. file, docker, syslog, journalctl) to the datasource stanza","Or include a field that uniquely identifies the source, such as 'filenames' for file or 'journalctl_filter' for journalctl","Check for typos in the source name that prevent both detection and explicit matching"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}