crowdsecurity/crowdsec · error

data source type is empty

Error message

data source type is empty

What it means

The acquisition registry maps module names to their data-source factories. LookupFactory requires a non-empty module name; an empty string can never be registered, so it immediately fails with this error instead of a registry miss.

Source

Thrown at pkg/acquisition/registry/registry.go:63

// It must be called in the init() function of the datasource package.
// In addition, the build component is registered so it will be reported
// by the "cscli version / crowdsec --version" commands.
func RegisterFactory(module string, factory types.DataSourceFactory) {
	component.Register("datasource_" + module)
	register(module, factory)
}

// RegisterTestFactory does not attempt to register it as a component,
// production code should call RegisterFactory() instead and make the datasource
// code optional using the appropriate build tag.
// This function may be called outside init().
func RegisterTestFactory(module string, factory types.DataSourceFactory) (restore func()) {
	return register(module, factory)
}

func LookupFactory(module string) (types.DataSourceFactory, error) {
	if module == "" {
		return nil, errors.New("data source type is empty")
	}

	mu.RLock()
	factory, registered := factoriesByName[module]
	mu.RUnlock()

	if registered {
		return factory, nil
	}

	built, known := component.Built["datasource_"+module]
	if !known {
		return nil, fmt.Errorf("unknown data source %s", module)
	}

	if built {
		panic("datasource " + module + " is built but not registered")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set the 'source:' field in each acquisition config entry to a registered module (e.g. file, journalctl, wineventlog)
2. Check that templating/variable substitution produces a non-empty source name
3. Inspect the DSN prefix if using DSN-based loading and ensure it names a module

Example fix

# before
---
filename: /var/log/syslog
# after
---
source: file
filename: /var/log/syslog

// Go: verify module name before registry lookup
if moduleName == "" {
    return fmt.Errorf("acquisition entry is missing a 'source:' field")
}
if _, err := registry.LookupFactory(moduleName); err != nil {
    return fmt.Errorf("unknown acquisition source %q: %w", moduleName, err)
}

factory, err := registry.LookupFactory(module)
if err != nil {
    return fmt.Errorf("cannot resolve acquisition source: %w", err)
}

When it happens

Trigger: Calling registry.LookupFactory("") directly, or via Validate / DataSourceConfigure / LoadAcquisitionFromDSN when the parsed 'source:' key or DSN-derived type is an empty string.

Common situations: An acquisition YAML entry missing the 'source:' key; an empty source value after templating; a DSN parsed such that the module segment is blank.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• max_body_size must be positive
• loki query is mandatory
• event_channel or xpath_query must be set
• no acquisition_path or acquisition_dir specified
• unknown data source %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d5f478e71a963548. Report an issue: GitHub.