crowdsecurity/crowdsec · error

start_date and end_date or backlog are mandatory in one-shot

Error message

start_date and end_date or backlog are mandatory in one-shot mode

What it means

Validation in ConfigureByDSN: the cloudwatch source runs in one-shot (cat) mode, and either StartTime or EndTime is nil. Unlike tail mode, cat mode must know exactly what window to fetch, so a time window (start_date+end_date, or backlog which sets both) is mandatory.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:295

		default:
			return fmt.Errorf("unexpected argument %s", k)
		}
	}

	s.logger.Tracef("host=%s", s.Config.GroupName)
	s.logger.Tracef("stream=%s", *s.Config.StreamName)
	s.Config.GetLogEventsPagesLimit = &def_GetLogEventsPagesLimit

	if err := s.newClient(ctx); err != nil {
		return err
	}

	if s.Config.StreamName == nil || s.Config.GroupName == "" {
		return errors.New("missing stream or group name")
	}

	if s.Config.StartTime == nil || s.Config.EndTime == nil {
		return errors.New("start_date and end_date or backlog are mandatory in one-shot mode")
	}

	s.Config.Mode = configuration.CAT_MODE
	s.streamIndexes = make(map[string]string)
	s.t = &tomb.Tomb{}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add both start_date and end_date parameters to the DSN
2. Or use backlog=<duration> to define the window relative to now
3. Switch to tail mode if you want continuous streaming without explicit dates

When it happens

Trigger: Thrown at pkg/acquisition/modules/cloudwatch/config.go:295 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c4bd878b8ba2d74e. Report an issue: GitHub.