{"record":{"id":"3229ae9edbab0caf","repo":"crowdsecurity/crowdsec","slug":"could-not-parse-journalctl-dsn-w","errorCode":null,"errorMessage":"could not parse journalctl DSN: %w","messagePattern":"could not parse journalctl DSN: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/config.go","lineNumber":96,"sourceCode":"\tvar (\n\t\tfilters  []string\n\t\tsince    string\n\t\tlogLevel log.Level\n\t)\n\n\t// format for the DSN is : journalctl://filters=FILTER1&filters=FILTER2\n\tif !strings.HasPrefix(dsn, \"journalctl://\") {\n\t\treturn fmt.Errorf(\"invalid DSN %s for journalctl source, must start with journalctl://\", dsn)\n\t}\n\n\tqs := strings.TrimPrefix(dsn, \"journalctl://\")\n\tif qs == \"\" {\n\t\treturn errors.New(\"empty journalctl:// DSN\")\n\t}\n\n\tparams, err := url.ParseQuery(qs)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not parse journalctl DSN: %w\", err)\n\t}\n\n\tfor key, value := range params {\n\t\tswitch key {\n\t\tcase \"filters\":\n\t\t\tfilters = append(filters, value...)\n\t\tcase \"log_level\":\n\t\t\tif len(value) != 1 {\n\t\t\t\treturn errors.New(\"expected exactly one value for 'log_level'\")\n\t\t\t}\n\n\t\t\tlvl, err := log.ParseLevel(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tlogLevel = lvl\n\t\tcase \"since\":","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/config.go#L78-L114","documentation":"After stripping the 'journalctl://' prefix, the remainder is parsed as a URL query string with url.ParseQuery. If that remainder contains malformed percent-encoding, an invalid escape, or a stray semicolon, ParseQuery fails and the error is wrapped with this message.","triggerScenarios":"Calling ConfigureByDSN with a DSN whose query part is malformed, e.g. 'journalctl://filters=%ZZ' (bad percent-escape) or 'journalctl://filters=a;b=1'.","commonSituations":"Filters containing characters that must be URL-encoded (&, =, %) pasted raw; shell variables expanding unexpectedly inside the DSN; truncated DSN strings.","solutions":["URL-encode the query values: replace spaces with %20, '%' with %25, '&' with %26.","Inspect the wrapped inner error ('invalid URL escape ...') to locate the exact bad character.","Keep filters to values without reserved query characters, or pre-encode them with url.QueryEscape.","Remove stray semicolons or unmatched '=' from the DSN."],"exampleFix":"// before\ns.ConfigureByDSN(\"journalctl://filters=_SYSTEMD_UNIT=sshd.service&_SYSTEMD_UNIT=100%\")\n// after\ns.ConfigureByDSN(\"journalctl://filters=_SYSTEMD_UNIT=sshd.service&filters=_SYSTEMD_UNIT=100%25\")","handlingStrategy":"validation","validationCode":"qs := strings.TrimPrefix(dsn, \"journalctl://\")\nif _, err := url.ParseQuery(qs); err != nil {\n    return fmt.Errorf(\"bad query part %q: %w\", qs, err)\n}","typeGuard":null,"tryCatchPattern":"if err := src.ConfigureByDSN(dsn); err != nil {\n    var pe *url.Error\n    if errors.As(err, &pe) { /* percent-encoding issue */ }\n}","preventionTips":["URL-encode filter values containing %, &, =, or spaces (url.QueryEscape)","Never paste raw journalctl flags into the query string","Check the inner 'invalid URL escape' message to pinpoint the bad character"],"tags":["go","dsn","url","querystring"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}