crowdsecurity/crowdsec · error

empty scope information

Error message

empty scope information

What it means

When building alert sources, if the bucket's ScopeType has no runtime filter and the event doesn't match earlier source branches, eventSources cannot determine what the alert is 'about' and returns this error. Every overflow needs a scope (IP, range, etc.) to attribute the alert.

Source

Thrown at pkg/leakybucket/overflows.go:190

			if leaky.Factory.Spec.ScopeType.RunTimeFilter != nil {
				retValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{"evt": &evt}, leaky.logger, leaky.Factory.Spec.Debug)
				if err != nil {
					return srcs, fmt.Errorf("while running scope filter: %w", err)
				}

				value, ok := retValue.(string)
				if !ok {
					value = ""
				}

				src.Value = &value
			}
		}

		srcs[*src.Value] = src
	default:
		if leaky.Factory.Spec.ScopeType.RunTimeFilter == nil {
			return srcs, errors.New("empty scope information")
		}

		retValue, err := exprhelpers.Run(leaky.Factory.Spec.ScopeType.RunTimeFilter, map[string]any{"evt": &evt}, leaky.logger, leaky.Factory.Spec.Debug)
		if err != nil {
			return srcs, fmt.Errorf("while running scope filter: %w", err)
		}

		value, ok := retValue.(string)
		if !ok {
			value = ""
		}

		src.Value = &value
		src.Scope = new(string)
		*src.Scope = leaky.Factory.Spec.ScopeType.Scope
		srcs[*src.Value] = src
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `scope:` entry (e.g. type: ip, expression: evt.Meta.source_ip) to the scenario
2. Fix the scope expression so it compiles into a runtime filter
3. Check that the scope type name is one supported by crowdsec (ip, range, email, username, ...)

Example fix

# before
name: x/no-scope
type: leaky
filter: "..."
# after
name: x/no-scope
type: leaky
scope:
  type: ip
  expression: evt.Meta.source_ip
filter: "..."

if bucket.Spec.ScopeTypes == nil || len(bucket.Spec.ScopeTypes) == 0 {
    return errors.New("scenario must define at least one scope with a valid expression")
}

When it happens

Trigger: An event overflows a bucket whose scope_types / ScopeType.RunTimeFilter is nil (missing or misconfigured scope in the scenario), so no source can be derived.

Common situations: Custom scenarios missing `scope:`/scope filter directives, or scope expressions failing to compile so RunTimeFilter stays nil.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• invalid threshold: must be > 0 and <= 1
• capacity must be -1
• bucket must have name
• description is mandatory
• missing filter directive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/137068933df58844. Report an issue: GitHub.