crowdsecurity/crowdsec · error

data source %s is not built in this version of crowdsec

Error message

data source %s is not built in this version of crowdsec

What it means

LookupFactory distinguishes between a datasource that does not exist at all and one that is a recognized crowdsec component which was simply not compiled into this binary (component.Built knows the name, but its build flag is false). In the latter case it throws 'data source %s is not built in this version of crowdsec'. This happens because crowdsec builds datasource modules conditionally with build tags (e.g. docker, k8s-audit may be excluded in some distro packages).

Source

Thrown at pkg/acquisition/registry/registry.go:83

	mu.RLock()
	factory, registered := factoriesByName[module]
	mu.RUnlock()

	if registered {
		return factory, nil
	}

	built, known := component.Built["datasource_"+module]
	if !known {
		return nil, fmt.Errorf("unknown data source %s", module)
	}

	if built {
		panic("datasource " + module + " is built but not registered")
	}

	return nil, fmt.Errorf("data source %s is not built in this version of crowdsec", module)
}

View on GitHub (pinned to 909b515798)

Solutions

1. Rebuild crowdsec from source with the full component set (standard 'make build' includes all datasources) or install the official full package
2. Replace the acquisition stanza with a datasource that is available in the installed build
3. Check 'crowdsec --version' / cscli version output: the components list shows which datasources this binary contains
4. If packaging your own build, enable the relevant build tag for the missing datasource module

Example fix

// before (slim build, no docker datasource)
source: docker
// after: rebuild full, or use file tail
source: file
  filenames:
    - /var/log/containers/*.log

out, _ := exec.Command("crowdsec", "--version").Output()
if !strings.Contains(string(out), "datasource_"+module) {
    log.Fatalf("datasource %s not in this build", module)
}

When it happens

Trigger: ParseSourceConfig/Validate/LoadAcquisitionFromDSN is asked for a known component (e.g. 'k8s-audit', 'docker', 'cloudwatch') in a binary where the corresponding build tag was off — typical of minimal distro packages, official non-full builds, or self-compiled crowdsec built with 'make build' without all components.

Common situations: User installs a slim package or compiles from source with a limited tag set, then reuses an acquis.yaml from a full installation referencing docker or k8s-audit; CI images with reduced binaries; using a DSN like docker:// with a binary where that module is excluded.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• unknown data source %s
• appsec datasource requires a hub. this is a bug, please repo
• appsec datasource requires a lapi client configuration. this
• stream_name is mandatory when use_enhanced_fanout is false
• max_body_size must be positive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b84b670e0633ba1f. Report an issue: GitHub.