crowdsecurity/crowdsec · error

unknown data source %s

Error message

unknown data source %s

What it means

LookupFactory resolves a datasource module name (from acquisition config 'source:' or a DSN) to its registered factory. If the module name is not in the registry AND not even known to the build-component table (component.Built has no entry 'datasource_<module>'), the name itself is not a datasource crowdsec knows about at all, so it throws 'unknown data source'. This is a name-resolution failure, distinct from a module that exists but was excluded from the build.

Source

Thrown at pkg/acquisition/registry/registry.go:76

	return register(module, factory)
}

func LookupFactory(module string) (types.DataSourceFactory, error) {
	if module == "" {
		return nil, errors.New("data source type is empty")
	}

	mu.RLock()
	factory, registered := factoriesByName[module]
	mu.RUnlock()

	if registered {
		return factory, nil
	}

	built, known := component.Built["datasource_"+module]
	if !known {
		return nil, fmt.Errorf("unknown data source %s", module)
	}

	if built {
		panic("datasource " + module + " is built but not registered")
	}

	return nil, fmt.Errorf("data source %s is not built in this version of crowdsec", module)
}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the 'source:' value against the list of valid datasources (linux: file, journalctl, syslog, docker, containerd, cloudwatch, k8s-audit, loki, etc.; windows: wineventlog)
2. Fix the typo or remove the invalid stanza from the acquisition config (.yaml under /etc/crowdsec/acquis.d or acquis.yaml)
3. If it is a third-party datasource, install the crowdsec build/plugin that provides it, or switch to a supported equivalent
4. Run cscli config show / crowdsec with -DEBUG to see which file and line produced the failing source name

Example fix

# before
source: winlog
  event_channel: Security
// after
source: wineventlog
  event_channel: Security

func validSource(name string) bool {
    valid := []string{"file","journalctl","syslog","docker","containerd","wineventlog","k8s-audit","cloudwatch","loki"}
    return slices.Contains(valid, name)
}
if !validSource(cfg.Source) { skip }

When it happens

Trigger: ParseSourceConfig / Validate / DataSourceConfigure / LoadAcquisitionFromDSN are given a source name that matches no known datasource: a typo in the 'source:' field (e.g. 'journalctlct'), a config written for a fork/plugin datasource that isn't installed, or invoking LoadAcquisitionFromDSN with a DSN scheme crowdsec does not recognize.

Common situations: User copies an acquisition snippet for an unsupported or third-party datasource; typo like 'source: journalclt' instead of 'journalctl'; a config file from a newer crowdsec version referencing a datasource this binary predates (though that usually lands on the 'not built' message instead); yaml indentation causing 'source:' value to pick up the wrong string.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• max_body_size must be positive
• loki query is mandatory
• event_channel or xpath_query must be set
• data source type is empty
• no acquisition_path or acquisition_dir specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/998e7e403689117e. Report an issue: GitHub.