{"record":{"id":"7ec23601a686dd06","repo":"crowdsecurity/crowdsec","slug":"log-level-must-be-a-single-value","errorCode":null,"errorMessage":"log_level must be a single value","messagePattern":"log_level must be a single value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":218,"sourceCode":"\t}\n\n\tif len(args) > 2 {\n\t\treturn errors.New(\"too many arguments in DSN\")\n\t}\n\n\ts.config.EventFile = args[0]\n\n\tif len(args) == 2 && args[1] != \"\" {\n\t\tparams, err := url.ParseQuery(args[1])\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse DSN parameters: %w\", err)\n\t\t}\n\n\t\tfor key, value := range params {\n\t\t\tswitch key {\n\t\t\tcase \"log_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"log_level must be a single value\")\n\t\t\t\t}\n\t\t\t\tlvl, err := log.ParseLevel(value[0])\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse log_level: %s\", err)\n\t\t\t\t}\n\t\t\t\ts.logger.Logger.SetLevel(lvl)\n\t\t\tcase \"event_id\":\n\t\t\t\tfor _, id := range value {\n\t\t\t\t\tevtid, err := strconv.Atoi(id)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"failed to parse event_id: %s\", err)\n\t\t\t\t\t}\n\t\t\t\t\ts.config.EventIDs = append(s.config.EventIDs, evtid)\n\t\t\t\t}\n\t\t\tcase \"event_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"event_level must be a single value\")\n\t\t\t\t}","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L200-L236","documentation":"In the DSN query string, the 'log_level' parameter must appear exactly once with one value. url.ParseQuery returns values as slices, so repeated keys (log_level=a&log_level=b) are rejected as ambiguous.","triggerScenarios":"ConfigureByDSN called with a DSN whose query string contains 'log_level' more than once, e.g. wineventlog://Security?log_level=info&log_level=debug.","commonSituations":"Template concatenation appending log_level twice; hand-editing a DSN and leaving a duplicate parameter; a loop building the query string without deduplicating keys.","solutions":["Keep a single log_level parameter in the DSN query string","Choose one level (e.g. log_level=info) and remove duplicates","Note this differs from a parse failure: if the single value is invalid you get 'failed to parse log_level' instead"],"exampleFix":"// before\nwineventlog://Security?log_level=info&log_level=debug\n// after\nwineventlog://Security?log_level=debug","handlingStrategy":"validation","validationCode":"// Go: deduplicate and validate log_level before building the DSN\nparams := url.Values{}\nparams.Set(\"log_level\", \"info\") // Set replaces, avoiding duplicates\nif _, err := log.ParseLevel(level); err != nil {\n    return fmt.Errorf(\"invalid log_level %q: %w\", level, err)\n}","typeGuard":null,"tryCatchPattern":"if err := src.ConfigureByDSN(dsn); err != nil {\n    return fmt.Errorf(\"bad wineventlog DSN params: %w\", err)\n}","preventionTips":["Use url.Values.Set (not Add) for single-value DSN parameters","Validate levels with log.ParseLevel before embedding","Never append the same key twice when building query strings"],"tags":["windows","acquisition","dsn","logging","wineventlog"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}