crowdsecurity/crowdsec · error

missing labels

Error message

missing labels

What it means

Generic guard in ParseSourceConfig: the datasource stanza carries no 'labels' mapping. Labels are mandatory on every datasource because they feed parser/scenario filtering in the pipeline; docker is the only exception since container labels are discovered at runtime. The check runs after source-type validation so unknown-source errors take priority over this one.

Source

Thrown at pkg/acquisition/acquisition.go:284

	parsed.Common = sub

	// could not detect, alas
	if sub.Source == "" {
		return nil, errors.New("missing 'source' field")
	}

	// pre-check that the source is valid
	_, err = registry.LookupFactory(sub.Source)
	if err != nil {
		return nil, err
	}

	// check for labels now, an error for missing labels has lower priority
	// than missing or unknown source type
	if len(sub.Labels) == 0 && sub.Source != "docker" {
		// docker is the only source that does not require labels
		return nil, errors.New("missing labels")
	}

	uniqueID := uuid.NewString()
	sub.UniqueId = uniqueID

	src, err := DataSourceConfigure(ctx, sub, yamlDoc, metricsLevel, hub)
	if err != nil {
		return nil, fmt.Errorf("datasource of type %s: %w", sub.Source, err)
	}
	parsed.Source = src

	if sub.TransformExpr != "" {
		vm, err := expr.Compile(sub.TransformExpr, exprhelpers.GetExprOptions(map[string]any{"evt": &pipeline.Event{}})...)
		if err != nil {
			return nil, fmt.Errorf("while compiling transform expression '%s' for datasource %s: %w", sub.TransformExpr, sub.Source, err)
		}

		parsed.Transform = vm

View on GitHub (pinned to 909b515798)

Solutions

1. Add a labels block to the datasource, e.g.: labels: type: syslog
2. Ensure the labels key is spelled 'labels' and is a mapping, not a list
3. Docker sources do not require labels; verify you did not mistype the source type as something else

When it happens

Trigger: Thrown at pkg/acquisition/acquisition.go:284 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9fa4ff2e80712747. Report an issue: GitHub.