crowdsecurity/crowdsec · error

bayesian conditions are required

Error message

bayesian conditions are required

What it means

BayesianType.Validate requires at least one Bayesian condition entry. This error means a bayesian bucket was declared with an empty `bayesian_conditions` list, so there is nothing to compute a posterior over and the bucket is rejected.

Source

Thrown at pkg/leakybucket/buckettype.go:109

		return errors.New("leakspeed is required")
	}

	if f.leakspeed <= 0 {
		return fmt.Errorf("invalid leakspeed '%s': must be > 0", f.Spec.LeakSpeed)
	}

	return nil
}

func (ConditionalType) BuildProcessors(_ *BucketFactory) []Processor {
	return []Processor{&DumbProcessor{}}
}

type BayesianType struct{}

func (BayesianType) Validate(f *BucketFactory) error {
	if len(f.Spec.BayesianConditions) == 0 {
		return errors.New("bayesian conditions are required")
	}

	if f.Spec.BayesianPrior <= 0 || f.Spec.BayesianPrior > 1 {
		return errors.New("invalid prior: must be > 0 and <= 1")
	}

	if f.Spec.BayesianThreshold == 0 || f.Spec.BayesianThreshold > 1 {
		return errors.New("invalid threshold: must be > 0 and <= 1")
	}

	if f.Spec.Capacity != -1 {
		return errors.New("capacity must be -1")
	}

	return nil
}

func (BayesianType) BuildProcessors(_ *BucketFactory) []Processor {

View on GitHub (pinned to 909b515798)

Solutions

1. Add at least one condition with name and probability, e.g. # bayesian_conditions: # - name: evt.MatchedCondition # probability: 0.5
2. Check YAML indentation so bayesian_conditions is inside the bucket spec block
3. Un-comment any accidentally disabled condition entries
4. Also set valid bayesian_prior and bayesian_threshold (validated next)

Example fix

// before
# type: bayesian
# bayesian_conditions: []
// after
# type: bayesian
# bayesian_conditions:
#   - name: evt.LoginFailure
#     probability: 0.6

// before loading the bucket config
if b.Spec.Type == "bayesian" {
    if len(b.Spec.BayesianConditions) == 0 { return fmt.Errorf("bayesian_conditions must list at least one condition") }
}

if err := BayesianType{}.Validate(factory); err != nil {
    if strings.Contains(err.Error(), "bayesian conditions are required") {
        return fmt.Errorf("bayesian bucket %q: add at least one bayesian_conditions entry with name and probability", factory.Name)
    }
    return err
}

When it happens

Trigger: Loading a bucket with type: bayesian whose spec has an empty or missing `bayesian_conditions:` list (len(f.Spec.BayesianConditions) == 0) during bucket factory validation.

Common situations: Writing a bayesian bucket for probabilistic alerting and leaving the conditions list empty; YAML indentation placing conditions outside the spec so they don't parse; all condition entries commented out.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• invalid prior: must be > 0 and <= 1
• leakspeed is required
• duration is required
• a condition is required
• invalid threshold: must be > 0 and <= 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0aeb0f557b8b8b97. Report an issue: GitHub.