crowdsecurity/crowdsec · error

journalctl_filter is required

Error message

journalctl_filter is required

What it means

The journalctl acquisition source requires at least one journalctl filter (e.g. a unit) to know which journal entries to read. Validate() (pkg/acquisition/modules/journalctl/config.go:48) rejects a Configuration with an empty Filters list.

Source

Thrown at pkg/acquisition/modules/journalctl/config.go:48

	cfg.SetDefaults()

	if err := cfg.Validate(); err != nil {
		return cfg, err
	}

	return cfg, nil
}

func (c *Configuration) SetDefaults() {
	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}
}

func (c *Configuration) Validate() error {
	if len(c.Filters) == 0 {
		return errors.New("journalctl_filter is required")
	}

	return nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	s.config = cfg

	s.setSrc(s.config.Filters)

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a journal_filter list to the config, e.g. journal_filter: [ _SYSTEMD_UNIT=ssh.service ].
2. If using a DSN, append the filters parameter: journalctl://?filters=_SYSTEMD_UNIT=ssh.service.
3. Check YAML indentation so the filter list actually parses into journal_filter.

Example fix

// before (acquis.yaml)
source: journalctl

// after
source: journalctl
journal_filter:
  - _SYSTEMD_UNIT=ssh.service

if len(cfg.Filters) == 0 {
    return errors.New("journalctl source requires at least one journal_filter entry")
}

func hasJournalFilters(cfg map[string]any) bool {
    f, ok := cfg["journal_filter"].([]any)
    return ok && len(f) > 0
}

if err := src.Validate(); err != nil {
    if strings.Contains(err.Error(), "journalctl_filter is required") {
        // add journal_filter to acquis.yaml and retry
    }
}

When it happens

Trigger: Starting a journalctl source whose config has no journal_filter entries — e.g. an empty acquis.yaml entry `source: journalctl` with no filters, or ConfigureByDSN called without a filters query parameter.

Common situations: Forgetting the journal_filter key in the YAML; YAML indentation mistake that silently drops the list; building the DSN programmatically and omitting the filters param.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• headers is selected, but headers is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/62e42f352be5fe7a. Report an issue: GitHub.