crowdsecurity/crowdsec · error

no labels key

Error message

no labels key

What it means

The entity is enabled via crowdsec.enable=true, but processCrowdsecLabels requires a 'crowdsec.labels' map that tells it which labels to apply to parsed events (e.g. type, program). When the 'labels' key is absent, the entity cannot be configured and is rejected.

Source

Thrown at pkg/acquisition/modules/docker/source.go:102

	if _, ok := parsedLabels["enable"]; !ok {
		d.logger.Errorf("%s has 'crowdsec' labels set but no 'crowdsec.enable' key found", entityType)
		return nil, errors.New("no crowdsec.enable key")
	}

	enable, ok := parsedLabels["enable"].(string)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set but it's not a string", entityType)
		return nil, errors.New("crowdsec.enable not a string")
	}

	if strings.ToLower(enable) != "true" {
		d.logger.Debugf("%s has 'crowdsec.enable' label not set to true ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("crowdsec.enable not true")
	}

	if _, ok = parsedLabels["labels"]; !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set to true but no 'labels' keys found", entityType)
		return nil, errors.New("no labels key")
	}

	labelsTypeCast, ok := parsedLabels["labels"].(map[string]any)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set to true but 'labels' is not a map", entityType)
		return nil, errors.New("labels not a map")
	}

	d.logger.Debugf("%s labels %+v", entityType, labelsTypeCast)

	labels := make(map[string]string)

	for k, v := range labelsTypeCast {
		if v, ok := v.(string); ok {
			log.Debugf("label %s is a string with value %s", k, v)
			labels[k] = v
			continue
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a crowdsec.labels map, e.g. crowdsec.labels.type=syslog (or labels: type: syslog under crowdsec in compose)
2. Ensure 'labels' is nested under the crowdsec key, not at the top level
3. Mirror a working example from the crowdsec docker acquisition docs and adapt it
4. Re-inspect the container to confirm both crowdsec.enable and crowdsec.labels are present

Example fix

# before
labels:
  - crowdsec.enable=true
# after
labels:
  - crowdsec.enable=true
  - crowdsec.labels.type=syslog

if strings.EqualFold(labels["crowdsec.enable"], "true") {
	if _, ok := labels["crowdsec.labels.type"]; !ok {
		return fmt.Errorf("container %s: crowdsec.labels map missing", ctr.ID)
	}
}

func hasLabelsMap(parsed map[string]any) bool {
	_, ok := parsed["labels"]
	return ok
}

if _, err := source.EvalContainer(ctx, ctr); err != nil {
	if err.Error() == "no labels key" {
		log.Errorf("container %s: set crowdsec.labels alongside crowdsec.enable=true", ctr.ID)
	}
}

When it happens

Trigger: EvalContainer/EvalService -> processCrowdsecLabels with parsedLabels containing enable=true but no 'labels' entry — e.g. only 'crowdsec.enable=true' set on the container.

Common situations: User enables acquisition but never sets crowdsec.labels (incomplete setup); labels block accidentally deleted during edit; wrong nesting so crowdsec.labels ends up as a sibling/flat label instead of a map.

Related errors

• no crowdsec.enable key
• crowdsec.enable not true
• crowdsec.enable not a string
• labels not a map
• missing lapi client credentials

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6d56f01079cce53c. Report an issue: GitHub.