What causes "missing mandatory 'tag' field in %s: %s" in crowdsecurity/crowdsec?

Add a non-empty "tag" value to the offending JSON line in the data file.

missing mandatory 'tag' field in %s: %s

Error message

missing mandatory 'tag' field in %s: %s

What it means

fileMapInit requires each JSON line of a filemap to carry a 'tag'. This error is thrown when the line parses as JSON and has a valid pattern, but the 'tag' field is missing or empty. The tag is mandatory because it is the value returned by map lookups used in expressions.

Source

Thrown at pkg/exprhelpers/filemap.go:55

	// Pre-compiled regexps for "regex" entries (checked last).
	regexPatterns []*regexp.Regexp
	regexToRow    []int // regex slice index → row index in fileMapEntry.rows
}

// fileMapInit parses a single JSON line and appends it to the fileMapEntry for the given filename.
// Three fields are mandatory: "pattern", "tag", and "type" (one of: "equals", "contains", "regex").
func fileMapInit(filename string, line string) error {
	var record map[string]string
	if err := json.Unmarshal([]byte(line), &record); err != nil {
		return fmt.Errorf("failed to parse JSON line in %s: %w", filename, err)
	}

	if record["pattern"] == "" {
		return fmt.Errorf("missing mandatory 'pattern' field in %s: %s", filename, line)
	}

	if record["tag"] == "" {
		return fmt.Errorf("missing mandatory 'tag' field in %s: %s", filename, line)
	}

	entryType := record["type"]
	if entryType == "" {
		return fmt.Errorf("missing mandatory 'type' field in %s: %s", filename, line)
	}

	if !slices.Contains(validMapEntryTypes, entryType) {
		return fmt.Errorf("unknown entry type '%s' in %s (supported: %s): %s",
			entryType, filename, strings.Join(validMapEntryTypes, ", "), line)
	}

	if entryType == "regex" {
		if _, err := regexp.Compile(record["pattern"]); err != nil {
			log.Warningf("invalid regex pattern in %s: %s", filename, err)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

Add a non-empty "tag" value to the offending JSON line in the data file.
Regenerate the file from its source, ensuring the tag/label column is included.
Validate the file line-by-line with jq before loading (check .tag exists and is non-empty).
If the entry genuinely has no meaningful label, give it an explicit placeholder tag instead of an empty string.

Example fix

// before
{"pattern":"10.0.0.5","type":"ip"}
// after
{"pattern":"10.0.0.5","tag":"internal","type":"ip"}

Defensive patterns

Strategy: validation

Validate before calling

for i, line := range lines {
	var rec map[string]string
	if err := json.Unmarshal([]byte(line), &rec); err != nil { /* skip */ }
	if rec["tag"] == "" {
		return fmt.Errorf("line %d: missing 'tag'", i+1)
	}
}

Prevention

Require pattern+tag+type columns when converting CSV sources to filemap JSON lines
Lint data files in CI before deployment
Never leave a tag blank as placeholder — use an explicit label

When it happens

Trigger: Calling FileInit (via fileMapInit) on a filemap line like {"pattern":"1.2.3.4","type":"ip"} where 'tag' is absent or "".

Common situations: Custom lookup tables built by omitting the tag column; converting CSV data to the JSON-lines filemap format and dropping the label column; template data files with placeholder tags left blank.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d3d4b20d3b330430. Report an issue: GitHub.