crowdsecurity/crowdsec · error

%s: ttl must be set

Error message

%s: ttl must be set

What it means

Stash.Validate() requires a `ttl` string, later parsed as a Go duration, to bound cache entries. Without it the stash would keep entries forever, so validation fails; if ttl is present, Strategy defaults to LRU automatically.

Source

Thrown at pkg/parser/stash.go:47

	ValueExpression *vm.Program
	TTLVal          time.Duration
}

func (s *Stash) Validate() error {
	if s.Name == "" {
		return errors.New("name must be set")
	}

	if s.Value == "" {
		return fmt.Errorf("%s: value expression must be set", s.Name)
	}

	if s.Key == "" {
		return fmt.Errorf("%s: key expression must be set", s.Name)
	}

	if s.TTL == "" {
		return fmt.Errorf("%s: ttl must be set", s.Name)
	}

	if s.Strategy == "" {
		s.Strategy = "LRU"
	}

	// should be configurable
	if s.MaxMapSize == 0 {
		s.MaxMapSize = 100
	}

	return nil
}

func (s *Stash) Compile(logger *log.Entry) (*RuntimeStash, error) {
	var err error

	rs := &RuntimeStash{Config: s}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `ttl:` duration to the stash, e.g. `ttl: 1h` or `ttl: 30m`.
2. Verify indentation so ttl belongs to the same stash mapping.
3. Restart crowdsec to confirm the stash validates and defaults Strategy to LRU.

Example fix

// before
- name: my-stash
  key: evt.Parsed.src_ip
  value: evt.Parsed.src_ip
// after
- name: my-stash
  key: evt.Parsed.src_ip
  value: evt.Parsed.src_ip
  ttl: 1h

if s.TTL == "" { return fmt.Errorf("stash %q: ttl required (e.g. 1h)", s.Name) }

if err := stash.Validate(); err != nil {
    return fmt.Errorf("invalid stash config: %w", err)
}

When it happens

Trigger: A `stash:` stanza lacks the `ttl:` field (or it is empty); Validate() runs at config load time.

Common situations: Minimal stash examples that omit ttl; a commented-out ttl line left in the config file.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• %s: value expression must be set
• %s: key expression must be set
• onsuccess %q not continue,next_stage
• stash %d: %w
• while parsing stash ttl: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/71265cc76d9aa170. Report an issue: GitHub.