{"record":{"id":"2c7b82a1720b0290","repo":"crowdsecurity/crowdsec","slug":"unsupported-key-s-in-journalctl-dsn","errorCode":null,"errorMessage":"unsupported key %s in journalctl DSN","messagePattern":"unsupported key (.+?) in journalctl DSN","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/config.go","lineNumber":121,"sourceCode":"\t\tcase \"log_level\":\n\t\t\tif len(value) != 1 {\n\t\t\t\treturn errors.New(\"expected exactly one value for 'log_level'\")\n\t\t\t}\n\n\t\t\tlvl, err := log.ParseLevel(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tlogLevel = lvl\n\t\tcase \"since\":\n\t\t\tif len(value) != 1 {\n\t\t\t\treturn errors.New(\"expected exactly one value for 'since'\")\n\t\t\t}\n\n\t\t\tsince = value[0]\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unsupported key %s in journalctl DSN\", key)\n\t\t}\n\t}\n\n\ts.config = Configuration{\n\t\tDataSourceCommonCfg: configuration.DataSourceCommonCfg{\n\t\t\tMode:     configuration.CAT_MODE,\n\t\t\tLabels:   labels,\n\t\t\tUniqueId: uuid,\n\t\t},\n\t\tFilters: filters,\n\t\tsince:   since,\n\t}\n\n\ts.setSrc(s.config.Filters)\n\ts.setLogger(logger, logLevel, s.src)\n\n\treturn nil\n}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/config.go#L103-L139","documentation":"The journalctl DSN query string only accepts the keys 'filters' and 'since' (plus log_level handling). Any other key present in the parsed query produces this error, since strict DSN parsing prevents silently ignored configuration.","triggerScenarios":"Calling ConfigureByDSN with e.g. 'journalctl://unit=sshd' or 'journalctl://filters=...&level=debug' — 'unit' and 'level' are unsupported key names.","commonSituations":"Users guessing key names from the systemd journalctl CLI flags (--unit, --level) instead of the documented DSN keys; mixing journalctl source config with journalctl command-line syntax.","solutions":["Replace the unsupported key with a supported one: 'filters' (repeatable) or 'since'.","Express journalctl flags as filter matches, e.g. --unit=sshd becomes filters=_SYSTEMD_UNIT=sshd.service.","Set verbosity via the source's log_level config in YAML, not a DSN key, unless the documented key list allows it.","Check the journalctl acquisition docs for the exact supported DSN parameter list."],"exampleFix":"// before\ns.ConfigureByDSN(\"journalctl://unit=sshd.service\")\n// after\ns.ConfigureByDSN(\"journalctl://filters=_SYSTEMD_UNIT=sshd.service\")","handlingStrategy":"validation","validationCode":"params, err := url.ParseQuery(strings.TrimPrefix(dsn, \"journalctl://\"))\nif err != nil { return err }\nfor k := range params {\n    switch k {\n    case \"filters\", \"since\":\n    default:\n        return fmt.Errorf(\"key %q is not supported; use filters or since\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := src.ConfigureByDSN(dsn); err != nil {\n    if strings.Contains(err.Error(), \"unsupported key\") {\n        // rewrite DSN with documented keys and retry\n    }\n}","preventionTips":["Only use the documented DSN keys: filters (repeatable) and since","Translate journalctl CLI flags into journal field filters (e.g. --unit -> _SYSTEMD_UNIT)","Keep a reference DSN example next to your acquis config"],"tags":["go","dsn","configuration","journalctl"],"backgroundTag":"unsupported-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}