crowdsecurity/crowdsec · error

loki query is mandatory

Error message

loki query is mandatory

What it means

Validation in the loki datasource's UnmarshalConfig: no logql query is configured. The Loki source reads logs by executing a query, so without one there is nothing to fetch and configuration fails. The query selects the log stream (selectors and filters) that crowdsec will ingest.

Source

Thrown at pkg/acquisition/modules/loki/config.go:49

	Limit                             int               `yaml:"limit"`  // Limit of logs to read
	DelayFor                          time.Duration     `yaml:"delay_for"`
	Since                             time.Duration     `yaml:"since"`
	Headers                           map[string]string `yaml:"headers"`        // HTTP headers for talking to Loki
	WaitForReady                      time.Duration     `yaml:"wait_for_ready"` // Retry interval, default is 10 seconds
	Auth                              AuthConfiguration `yaml:"auth"`
	MaxFailureDuration                time.Duration     `yaml:"max_failure_duration"` // Max duration of failure before stopping the source
	NoReadyCheck                      bool              `yaml:"no_ready_check"`       // Bypass /ready check before starting
	configuration.DataSourceCommonCfg                   `yaml:",inline"`
}

func (l *Source) UnmarshalConfig(yamlConfig []byte) error {
	err := yaml.UnmarshalWithOptions(yamlConfig, &l.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse loki acquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if l.Config.Query == "" {
		return errors.New("loki query is mandatory")
	}

	if l.Config.WaitForReady == 0 {
		l.Config.WaitForReady = 10 * time.Second
	}

	if l.Config.DelayFor < 0*time.Second || l.Config.DelayFor > 5*time.Second {
		return errors.New("delay_for should be a value between 1s and 5s")
	}

	if l.Config.Mode == "" {
		l.Config.Mode = configuration.TAIL_MODE
	}

	if l.Config.Prefix == "" {
		l.Config.Prefix = "/"
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `query: '{job="myapp"}'` LogQL selector to the loki acquisition config
2. Verify the query key is spelled correctly and non-empty under the source's config block
3. Check strict-YAML parse didn't drop your value due to bad indentation

Example fix

// before
source: loki
loki_url: http://localhost:3100
// after
source: loki
loki_url: http://localhost:3100
query: '{job="myapp"}'

if strings.TrimSpace(cfg.Query) == "" {
    return errors.New("loki query is required")
}

When it happens

Trigger: A loki.yaml acquisition config (or loki:// DSN path) parsed via UnmarshalConfig with an empty or missing `query:` field.

Common situations: Copying an example config and deleting the query, forgetting to fill the template placeholder, or quoting issues leaving the field empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• max_body_size must be positive
• delay_for should be a value between 1s and 5s
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5db4157145614e1e. Report an issue: GitHub.