{"record":{"id":"014e4d899d9eb0f1","repo":"crowdsecurity/crowdsec","slug":"cannot-parse-s-014e4d","errorCode":null,"errorMessage":"cannot parse: %s","messagePattern":"cannot parse: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/config.go","lineNumber":28,"sourceCode":"\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n)\n\ntype Configuration struct {\n\tProto                             string `yaml:\"protocol,omitempty\"`\n\tPort                              int    `yaml:\"listen_port,omitempty\"`\n\tAddr                              string `yaml:\"listen_addr,omitempty\"`\n\tMaxMessageLen                     int    `yaml:\"max_message_len,omitempty\"`\n\tDisableRFCParser                  bool   `yaml:\"disable_rfc_parser,omitempty\"` // if true, we don't try to be smart and just remove the PRI\n\tconfiguration.DataSourceCommonCfg `yaml:\",inline\"`\n}\n\nfunc ConfigurationFromYAML(y []byte) (Configuration, error) {\n\tvar cfg Configuration\n\n\tif err := yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()); err != nil {\n\t\treturn cfg, fmt.Errorf(\"cannot parse: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tcfg.SetDefaults()\n\n\tif err := cfg.Validate(); err != nil {\n\t\treturn cfg, err\n\t}\n\n\treturn cfg, nil\n}\n\nfunc (c *Configuration) SetDefaults() {\n\tif c.Mode == \"\" {\n\t\tc.Mode = configuration.TAIL_MODE\n\t}\n\n\tif c.Addr == \"\" {\n\t\tc.Addr = \"127.0.0.1\" // do we want a usable or secure default ?","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/config.go#L10-L46","documentation":"ConfigurationFromYAML unmarshals the syslog acquisition config with yaml.Strict(), so unknown fields or type mismatches are errors. The strict-mode yaml error is formatted and returned as 'cannot parse: ...'.","triggerScenarios":"Loading a syslog source config whose YAML contains keys not defined in the Configuration struct (e.g. a misspelled field like `maxden` instead of `max_denied`), wrong indentation, or a value of the wrong type.","commonSituations":"Hand-edited acquis.yaml with typos; copying config fields from other data sources (e.g. journalctl-specific options); upgrading crowdsec after a field was renamed; tabs instead of spaces.","solutions":["Read the formatted error after 'cannot parse:' — it names the unknown field or type mismatch and its line.","Remove or correct the unknown/mistyped field in the YAML.","Cross-check against the syslog source's documented configuration keys.","Use spaces, not tabs, and verify indentation depth."],"exampleFix":"// before\nsource: syslog\nmaxden: 10\n// after\nsource: syslog\nmax_denied: 10","handlingStrategy":"validation","validationCode":"var cfg map[string]interface{}\nif err := yaml.Unmarshal(y, &cfg); err != nil {\n    return err\n}\nallowed := map[string]bool{\"source\":true,\"protocol\":true,\"listen_addr\":true,\"port\":true /* ... */}\nfor k := range cfg {\n    if !allowed[k] { return fmt.Errorf(\"unknown syslog config key %q\", k) }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := syslog.ConfigurationFromYAML(data)\nif err != nil {\n    return fmt.Errorf(\"syslog acquisition config rejected: %w\", err)\n}","preventionTips":["Validate acquis.yaml with `cscli hubtool` or a config dry-run before restart.","Only copy documented keys for the syslog source.","Check the changelog for renamed fields when upgrading.","Use spaces, not tabs, in acquisition YAML."],"tags":["yaml","configuration","syslog","acquisition"],"backgroundTag":"yaml-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}