crowdsecurity/crowdsec · error

group_name is mandatory for CloudwatchSource

Error message

group_name is mandatory for CloudwatchSource

What it means

CloudwatchSource.Validate() enforces that a group_name is present in the cloudwatch datasource configuration — it identifies the CloudWatch Logs log group to read. An empty group_name makes the datasource impossible to configure, so validation fails.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:104

	}

	if c.AwsApiCallTimeout == nil {
		c.AwsApiCallTimeout = &def_AwsApiCallTimeout
	}

	if c.AwsConfigDir == nil {
		c.AwsConfigDir = &def_AwsConfigDir
	}
}


type ValidationWarning string

func (c *Configuration) Validate() ([]ValidationWarning, error) {
	var warns []ValidationWarning

	if c.GroupName == "" {
		return warns, errors.New("group_name is mandatory for CloudwatchSource")
	}

	if *c.MaxStreamAge > *c.StreamReadTimeout {
		warns = append(warns, "max_stream_age > stream_read_timeout, stream might keep being opened/closed")
	}

	return warns, nil
}


func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, warns, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	for _, w := range warns {
		s.logger.Warn(w)

View on GitHub (pinned to 909b515798)

Solutions

1. Set group_name to your CloudWatch Logs log group name in the cloudwatch datasource config
2. Fix YAML nesting/typo so group_name sits under the datasource entry
3. Check the exact group name in the AWS console (case-sensitive)

Example fix

// before
source: cloudwatch
aws_region: us-east-1
// after
source: cloudwatch
aws_region: us-east-1
group_name: /my/log/group
stream_name: my-stream

if cwCfg.GroupName == "" { return errors.New("cloudwatch datasource requires group_name") }

warns, err := cfg.Validate()
if err != nil {
    if strings.Contains(err.Error(), "group_name is mandatory") { /* set group_name */ }
    return err
}

When it happens

Trigger: ConfigurationFromYAML parses a cloudwatch datasource whose group_name is empty/absent, then calls Validate() which returns this error.

Common situations: Missing group_name key in acquisition.yaml; empty value (group_name: ""); YAML indentation nesting group_name outside the datasource stanza.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• aws_region is not specified, specify it or aws_config_dir
• can't read aws_config_dir %s got err %w
• while compiling regexp '%s': %w
• query is mandatory (at least start_date and end_date or back
• cloudwatch path must contain group and stream : /my/group/na

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c91c3e14a5dc2650. Report an issue: GitHub.