crowdsecurity/crowdsec · error

a condition is required

Error message

a condition is required

What it means

ConditionalType.Validate requires a conditional bucket to declare a `conditional_overflow` expression naming the bucket it overflows on. This error means that condition string is empty, so the bucket has no trigger and cannot be constructed.

Source

Thrown at pkg/leakybucket/buckettype.go:87

		return fmt.Errorf("invalid duration '%d': must be > 0", f.duration)
	}

	return nil
}

func (CounterType) BuildProcessors(_ *BucketFactory) []Processor {
	return []Processor{&DumbProcessor{}}
}

type ConditionalType struct{}

func (ConditionalType) Validate(f *BucketFactory) error {
	if f.Spec.Capacity != -1 {
		f.logger.Warnf("Using a value different than -1 as capacity for conditional bucket, this may lead to unexpected overflows")
	}

	if f.Spec.ConditionalOverflow == "" {
		return errors.New("a condition is required")
	}

	if f.Spec.LeakSpeed == "" {
		return errors.New("leakspeed is required")
	}

	if f.leakspeed <= 0 {
		return fmt.Errorf("invalid leakspeed '%s': must be > 0", f.Spec.LeakSpeed)
	}

	return nil
}

func (ConditionalType) BuildProcessors(_ *BucketFactory) []Processor {
	return []Processor{&DumbProcessor{}}
}

type BayesianType struct{}

View on GitHub (pinned to 909b515798)

Solutions

1. Add the conditional_overflow expression referencing the feeder bucket, e.g. `conditional_overflow: my_feeder_bucket`
2. Also set a valid `leakspeed` (Validate checks it next, at buckettype.go:91)
3. Verify the referenced bucket name matches the feeder bucket's `name` field
4. Check YAML indentation so the field is inside the conditional bucket's spec

Example fix

// before
# type: conditional
# leakspeed: 10s
// after
# type: conditional
# leakspeed: 10s
# conditional_overflow: my_group_bucket

// before loading the bucket config
if b.Spec.Type == "conditional" {
    if b.Spec.ConditionalOverflow == "" { return fmt.Errorf("conditional_overflow is required") }
    if b.Spec.LeakSpeed == "" { return fmt.Errorf("leakspeed is required") }
}

if err := ConditionalType{}.Validate(factory); err != nil {
    if strings.Contains(err.Error(), "a condition is required") {
        return fmt.Errorf("conditional bucket %q: set conditional_overflow to the feeder bucket name", factory.Name)
    }
    return err
}

When it happens

Trigger: Loading a bucket with type: conditional whose spec lacks `conditional_overflow:` (f.Spec.ConditionalOverflow == ""), during bucket factory validation.

Common situations: Defining a conditional bucket for group-based alerting but forgetting to reference the feeder bucket's name; typos in the field name; copying a leaky bucket and changing only `type:`.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• leakspeed is required
• duration is required
• bayesian conditions are required
• invalid prior: must be > 0 and <= 1
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8fdd5a168b9315db. Report an issue: GitHub.