# Log-Files filled with "Unable to enrich ip '-'"

**URL:** <https://discourse.crowdsec.net/t/log-files-filled-with-unable-to-enrich-ip/1978>\
**Category:** crowdsec\
**Created:** [August 26, 2024, 8:21am UTC](https://discourse.crowdsec.net/t/log-files-filled-with-unable-to-enrich-ip/1978 "2024-08-26T08:21:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chaos](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@Chaos](https://discourse.crowdsec.net/u/Chaos)\
**Post date:** [August 26, 2024, 8:21am UTC](https://discourse.crowdsec.net/t/log-files-filled-with-unable-to-enrich-ip/1978/1 "2024-08-26T08:21:56Z")

</div>

When I look into the crowdsec.log file I see many of these entries:

> time=“2024-08-26T10:06:36+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:39+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:39+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:39+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:39+02:00” level=error msg=“unable to collect sources from bucket: while extracting scope from bucket crowdsecurity/windows-bf: scope is Ip but ‘-’ isn’t a valid ip”  
> time=“2024-08-26T10:06:41+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:41+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:06:41+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpCity name=crowdsecurity/geoip-enrich stage=s02-enrich  
> time=“2024-08-26T10:07:08+02:00” level=error msg=“Unable to enrich ip ‘-’” id=summer-water method=GeoIpASN name=crowdsecurity/geoip-enrich stage=s02-enrich

I am not sure, where the source of this is. Did I configure something wrong or did I use wrong syntax? Crowdsec is running on Windows and most of the events that are investigated are “windows/bf” or “exchange/bf”.

I want to see “errors” in the logs and don’t want to lower the logging level.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [August 27, 2024, 2:07pm UTC](https://discourse.crowdsec.net/t/log-files-filled-with-unable-to-enrich-ip/1978/2 "2024-08-27T14:07:31Z")

</div>

It seems the `evt.Meta.source_ip` is being set to `-` so maybe these events dont have an IP or something is broken from windows versioning.