{"record":{"id":"998e7e403689117e","repo":"crowdsecurity/crowdsec","slug":"unknown-data-source-s","errorCode":null,"errorMessage":"unknown data source %s","messagePattern":"unknown data source (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/registry/registry.go","lineNumber":76,"sourceCode":"\treturn register(module, factory)\n}\n\nfunc LookupFactory(module string) (types.DataSourceFactory, error) {\n\tif module == \"\" {\n\t\treturn nil, errors.New(\"data source type is empty\")\n\t}\n\n\tmu.RLock()\n\tfactory, registered := factoriesByName[module]\n\tmu.RUnlock()\n\n\tif registered {\n\t\treturn factory, nil\n\t}\n\n\tbuilt, known := component.Built[\"datasource_\"+module]\n\tif !known {\n\t\treturn nil, fmt.Errorf(\"unknown data source %s\", module)\n\t}\n\n\tif built {\n\t\tpanic(\"datasource \" + module + \" is built but not registered\")\n\t}\n\n\treturn nil, fmt.Errorf(\"data source %s is not built in this version of crowdsec\", module)\n}\n","sourceCodeStart":58,"sourceCodeEnd":85,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/registry/registry.go#L58-L85","documentation":"LookupFactory resolves a datasource module name (from acquisition config 'source:' or a DSN) to its registered factory. If the module name is not in the registry AND not even known to the build-component table (component.Built has no entry 'datasource_<module>'), the name itself is not a datasource crowdsec knows about at all, so it throws 'unknown data source'. This is a name-resolution failure, distinct from a module that exists but was excluded from the build.","triggerScenarios":"ParseSourceConfig / Validate / DataSourceConfigure / LoadAcquisitionFromDSN are given a source name that matches no known datasource: a typo in the 'source:' field (e.g. 'journalctlct'), a config written for a fork/plugin datasource that isn't installed, or invoking LoadAcquisitionFromDSN with a DSN scheme crowdsec does not recognize.","commonSituations":"User copies an acquisition snippet for an unsupported or third-party datasource; typo like 'source: journalclt' instead of 'journalctl'; a config file from a newer crowdsec version referencing a datasource this binary predates (though that usually lands on the 'not built' message instead); yaml indentation causing 'source:' value to pick up the wrong string.","solutions":["Check the 'source:' value against the list of valid datasources (linux: file, journalctl, syslog, docker, containerd, cloudwatch, k8s-audit, loki, etc.; windows: wineventlog)","Fix the typo or remove the invalid stanza from the acquisition config (.yaml under /etc/crowdsec/acquis.d or acquis.yaml)","If it is a third-party datasource, install the crowdsec build/plugin that provides it, or switch to a supported equivalent","Run cscli config show / crowdsec with -DEBUG to see which file and line produced the failing source name"],"exampleFix":"# before\nsource: winlog\n  event_channel: Security\n// after\nsource: wineventlog\n  event_channel: Security","handlingStrategy":"validation","validationCode":"func validSource(name string) bool {\n    valid := []string{\"file\",\"journalctl\",\"syslog\",\"docker\",\"containerd\",\"wineventlog\",\"k8s-audit\",\"cloudwatch\",\"loki\"}\n    return slices.Contains(valid, name)\n}\nif !validSource(cfg.Source) { skip }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy acquisition snippets only from docs matching your crowdsec version","Lint acquis.yaml files before deploying (crowdsec -t -c config.yaml validates config)","Keep the source: value lowercase and exact","Diff config between environments when migrating"],"tags":["acquisition","config","datasource"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}