Hello guys! I’m currently trying to setup my first data source:
acquis.d/journalctl.yaml
:
source: journalctl
journalctl_filter:
- "-k"
labels:
type: syslog
however, I’m getting the following error message:
crowdsec init: while loading acquisition config: no datasource enabled
may I ask what I’m doing wrong?