crowdsecurity/crowdsec · error

VictoriaLogs query is mandatory

Error message

VictoriaLogs query is mandatory

What it means

The VictoriaLogs datasource is query-driven: a LogsQL 'query' selects which logs to tail. UnmarshalConfig requires a non-empty query; if absent it returns 'VictoriaLogs query is mandatory' after the url check.

Source

Thrown at pkg/acquisition/modules/victorialogs/config.go:53

	Headers                           map[string]string   `yaml:"headers"`        // HTTP headers for talking to VictoriaLogs
	WaitForReady                      time.Duration       `yaml:"wait_for_ready"` // Retry interval, default is 10 seconds
	Auth                              AuthConfiguration `yaml:"auth"`
	MaxFailureDuration                time.Duration       `yaml:"max_failure_duration"` // Max duration of failure before stopping the source
	configuration.DataSourceCommonCfg `yaml:",inline"`
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	err := yaml.UnmarshalWithOptions(yamlConfig, &s.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse VictoriaLogs acquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.Config.URL == "" {
		return errors.New("VictoriaLogs url is mandatory")
	}

	if s.Config.Query == "" {
		return errors.New("VictoriaLogs query is mandatory")
	}

	if s.Config.WaitForReady == 0 {
		s.Config.WaitForReady = 10 * time.Second
	}

	if s.Config.Mode == "" {
		s.Config.Mode = configuration.TAIL_MODE
	}

	if s.Config.Prefix == "" {
		s.Config.Prefix = "/"
	}

	if !strings.HasSuffix(s.Config.Prefix, "/") {
		s.Config.Prefix += "/"
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a query to the config, e.g. query: '*' to ingest all logs or a LogsQL filter like query: '_time:1h AND app:"crowdsec"'
2. Uncomment the query line in the acquisition YAML
3. Test the query against VictoriaLogs' web UI before adding it

Example fix

// before
source: victorialogs
url: http://victorialogs:9428
// after
source: victorialogs
url: http://victorialogs:9428
query: '*'

if cfg["query"] == "" { return errors.New("victorialogs query is required") }

When it happens

Trigger: Acquisition YAML with url set but no 'query:' key, or query: '' (empty string).

Common situations: Template configs where the query line was deleted or commented out; user unsure of LogsQL syntax leaving it blank; automated config generation dropping empty fields.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• VictoriaLogs url is mandatory
• no appsec_config provided
• empty host
• cannot parse: %s
• cannot parse: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c56fa57ec805b82d. Report an issue: GitHub.