crowdsecurity/crowdsec · error

empty yaml document

Error message

empty yaml document

What it means

Sentinel error ErrEmptyYAMLDocument returned by ParseSourceConfig when csyaml.IsEmptyYAML reports the datasource document contains no keys (only comments or whitespace). It is not a real failure: the acquisition loader explicitly skips documents that return this error (errors.Is check at acquisition.go:369), treating them as intentionally empty stanzas in a multi-document acquis file.

Source

Thrown at pkg/acquisition/acquisition.go:217

		return "file", nil
	case slices.Contains(keys, "filenames"):
		return "file", nil
	case slices.Contains(keys, "journalctl_filter"):
		return "journalctl", nil
	default:
		return "", nil
	}
}

type ParsedSourceConfig struct {
	Common           configuration.DataSourceCommonCfg
	Source           types.DataSource
	Transform        *vm.Program
	SourceMissing    bool   // the "source" field was missing, and detected
	SourceOverridden string // the "source" field was not missing, but didn't match the detected one
}

var ErrEmptyYAMLDocument = errors.New("empty yaml document")

// ParseSourceConfig validates and configures one YAML document.
//
// It does not expand env variables, they must already be expanded.
//
// - return sentinel error for empty/comment-only documents
// - backward-compat source auto-detection (filename/filenames/journalctl_filter)
// - validate common fields
// - delegate per-source config validation to the appropriate module
// - compile transform expression
func ParseSourceConfig(ctx context.Context, yamlDoc []byte, metricsLevel metrics.AcquisitionMetricsLevel, hub *cwhub.Hub) (*ParsedSourceConfig, error) {
	detectedType, err := detectType(bytes.NewReader(yamlDoc))
	if err != nil {
		return nil, err
	}

	// if there are not keys or only comments, the document will be skipped
	empty, err := csyaml.IsEmptyYAML(bytes.NewReader(yamlDoc))

View on GitHub (pinned to 909b515798)

Solutions

1. No action needed if the document is intentionally a placeholder — the loader skips it silently
2. Remove the empty/comment-only YAML document from acquisition.yaml to silence the skip
3. If you expected the datasource to load, check it is not commented out or lost its keys during an edit

When it happens

Trigger: Thrown at pkg/acquisition/acquisition.go:217 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/89ddfcb929a61ee4. Report an issue: GitHub.