{"record":{"id":"c56fa57ec805b82d","repo":"crowdsecurity/crowdsec","slug":"victorialogs-query-is-mandatory","errorCode":null,"errorMessage":"VictoriaLogs query is mandatory","messagePattern":"VictoriaLogs query is mandatory","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/victorialogs/config.go","lineNumber":53,"sourceCode":"\tHeaders                           map[string]string   `yaml:\"headers\"`        // HTTP headers for talking to VictoriaLogs\n\tWaitForReady                      time.Duration       `yaml:\"wait_for_ready\"` // Retry interval, default is 10 seconds\n\tAuth                              AuthConfiguration `yaml:\"auth\"`\n\tMaxFailureDuration                time.Duration       `yaml:\"max_failure_duration\"` // Max duration of failure before stopping the source\n\tconfiguration.DataSourceCommonCfg `yaml:\",inline\"`\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\terr := yaml.UnmarshalWithOptions(yamlConfig, &s.Config, yaml.Strict())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse VictoriaLogs acquisition configuration: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tif s.Config.URL == \"\" {\n\t\treturn errors.New(\"VictoriaLogs url is mandatory\")\n\t}\n\n\tif s.Config.Query == \"\" {\n\t\treturn errors.New(\"VictoriaLogs query is mandatory\")\n\t}\n\n\tif s.Config.WaitForReady == 0 {\n\t\ts.Config.WaitForReady = 10 * time.Second\n\t}\n\n\tif s.Config.Mode == \"\" {\n\t\ts.Config.Mode = configuration.TAIL_MODE\n\t}\n\n\tif s.Config.Prefix == \"\" {\n\t\ts.Config.Prefix = \"/\"\n\t}\n\n\tif !strings.HasSuffix(s.Config.Prefix, \"/\") {\n\t\ts.Config.Prefix += \"/\"\n\t}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/victorialogs/config.go#L35-L71","documentation":"The VictoriaLogs datasource is query-driven: a LogsQL 'query' selects which logs to tail. UnmarshalConfig requires a non-empty query; if absent it returns 'VictoriaLogs query is mandatory' after the url check.","triggerScenarios":"Acquisition YAML with url set but no 'query:' key, or query: '' (empty string).","commonSituations":"Template configs where the query line was deleted or commented out; user unsure of LogsQL syntax leaving it blank; automated config generation dropping empty fields.","solutions":["Add a query to the config, e.g. query: '*' to ingest all logs or a LogsQL filter like query: '_time:1h AND app:\"crowdsec\"'","Uncomment the query line in the acquisition YAML","Test the query against VictoriaLogs' web UI before adding it"],"exampleFix":"// before\nsource: victorialogs\nurl: http://victorialogs:9428\n// after\nsource: victorialogs\nurl: http://victorialogs:9428\nquery: '*'","handlingStrategy":"validation","validationCode":"if cfg[\"query\"] == \"\" { return errors.New(\"victorialogs query is required\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always ship query: '*' as a safe default in templates","Test LogsQL queries in VictoriaLogs UI first","Don't comment out required keys when tweaking configs"],"tags":["yaml","configuration","victorialogs"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}