crowdsecurity/crowdsec · error

delay_for should be a value between 1s and 5s

Error message

delay_for should be a value between 1s and 5s

What it means

The loki source's delay_for parameter controls how long to wait before re-querying to tolerate out-of-order entries. UnmarshalConfig rejects values below 0s (the message says between 1s and 5s but the check enforces 0s..5s) or above 5s, because Loki tailing expects this bounded retry delay.

Source

Thrown at pkg/acquisition/modules/loki/config.go:57

	configuration.DataSourceCommonCfg                   `yaml:",inline"`
}

func (l *Source) UnmarshalConfig(yamlConfig []byte) error {
	err := yaml.UnmarshalWithOptions(yamlConfig, &l.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse loki acquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if l.Config.Query == "" {
		return errors.New("loki query is mandatory")
	}

	if l.Config.WaitForReady == 0 {
		l.Config.WaitForReady = 10 * time.Second
	}

	if l.Config.DelayFor < 0*time.Second || l.Config.DelayFor > 5*time.Second {
		return errors.New("delay_for should be a value between 1s and 5s")
	}

	if l.Config.Mode == "" {
		l.Config.Mode = configuration.TAIL_MODE
	}

	if l.Config.Prefix == "" {
		l.Config.Prefix = "/"
	}

	if !strings.HasSuffix(l.Config.Prefix, "/") {
		l.Config.Prefix += "/"
	}

	if l.Config.Limit == 0 {
		l.Config.Limit = lokiLimit
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set delay_for to a duration between 0s and 5s, e.g. delay_for: 1s
2. Remove delay_for to use the zero default
3. Check for unit typos (delay_for: 5m parses as 5 minutes and exceeds the limit)

Example fix

// before
delay_for: 30s
// after
delay_for: 3s

d, err := time.ParseDuration(cfg.DelayFor)
if err != nil || d < 0 || d > 5*time.Second {
    return fmt.Errorf("delay_for must be between 0s and 5s")
}

When it happens

Trigger: A loki acquisition config or loki:// DSN with `delay_for` set to a duration > 5s or < 0 (e.g. delay_for: 30s or -1s), evaluated in UnmarshalConfig or in ConfigureByDSN's delay_for parameter.

Common situations: Users copy the promtail delay_for semantics (unbounded) or set it large thinking it's a general poll interval.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• loki query is mandatory
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f5acd0f11fe130af. Report an issue: GitHub.