crowdsecurity/crowdsec · error

missing 'source' field

Error message

missing 'source' field

What it means

Generic guard in ParseSourceConfig: after both explicit declaration and type detection, sub.Source is still empty. The loader tried to infer the datasource type from characteristic keys (filenames, journalctl_filter, etc.) and found none, and the user did not set 'source' — so there is no way to know which acquisition module to instantiate. SourceMissing/SourceOverridden on ParsedSourceConfig record the detection details for the caller.

Source

Thrown at pkg/acquisition/acquisition.go:271

	// report that the user did not specify a source
	if sub.Source == "" {
		parsed.SourceMissing = true
	}

	// report that the user specified a source that doesn't match with one detected from the presence of other fields
	if detectedType != "" {
		if sub.Source != "" && sub.Source != detectedType {
			parsed.SourceOverridden = sub.Source
		}

		sub.Source = detectedType
	}

	parsed.Common = sub

	// could not detect, alas
	if sub.Source == "" {
		return nil, errors.New("missing 'source' field")
	}

	// pre-check that the source is valid
	_, err = registry.LookupFactory(sub.Source)
	if err != nil {
		return nil, err
	}

	// check for labels now, an error for missing labels has lower priority
	// than missing or unknown source type
	if len(sub.Labels) == 0 && sub.Source != "docker" {
		// docker is the only source that does not require labels
		return nil, errors.New("missing labels")
	}

	uniqueID := uuid.NewString()
	sub.UniqueId = uniqueID

View on GitHub (pinned to 909b515798)

Solutions

1. Add an explicit 'source: <type>' key (e.g. file, docker, syslog, journalctl) to the datasource stanza
2. Or include a field that uniquely identifies the source, such as 'filenames' for file or 'journalctl_filter' for journalctl
3. Check for typos in the source name that prevent both detection and explicit matching

When it happens

Trigger: Thrown at pkg/acquisition/acquisition.go:271 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/90f5709b2d30d9ce. Report an issue: GitHub.