{"record":{"id":"87e91935a0a51fdc","repo":"crowdsecurity/crowdsec","slug":"cannot-parse-s-87e919","errorCode":null,"errorMessage":"cannot parse: %s","messagePattern":"cannot parse: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/config.go","lineNumber":28,"sourceCode":"\tyaml \"github.com/goccy/go-yaml\"\n\tlog \"github.com/sirupsen/logrus\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n)\n\ntype Configuration struct {\n\tconfiguration.DataSourceCommonCfg `yaml:\",inline\"`\n\n\tFilters []string `yaml:\"journalctl_filter\"`\n\tsince   string   // set only by DSN\n}\n\nfunc ConfigurationFromYAML(y []byte) (Configuration, error) {\n\tvar cfg Configuration\n\n\tif err := yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()); err != nil {\n\t\treturn cfg, fmt.Errorf(\"cannot parse: %s\", yaml.FormatError(err, false, false))\n\t}\n\n\tcfg.SetDefaults()\n\n\tif err := cfg.Validate(); err != nil {\n\t\treturn cfg, err\n\t}\n\n\treturn cfg, nil\n}\n\nfunc (c *Configuration) SetDefaults() {\n\tif c.Mode == \"\" {\n\t\tc.Mode = configuration.TAIL_MODE\n\t}\n}\n\nfunc (c *Configuration) Validate() error {","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/config.go#L10-L46","documentation":"The journalctl acquisition source parses its YAML configuration with strict (unknown-field-rejecting) mode. If the YAML block for this source is not valid YAML or contains keys not present in the Configuration struct, the unmarshal fails and the error is wrapped as 'cannot parse: <detail>'. The detail from yaml.FormatError names the exact offending field or line.","triggerScenarios":"Calling ConfigurationFromYAML (via UnmarshalConfig) with a YAML blob that has a typo'd or unknown key (e.g. 'journald:' instead of a known field), wrong type for a field, or syntactically invalid YAML.","commonSituations":"Users editing acquis.yaml add a field from an old or third-party example; indentation mistakes; quoting issues in filters; running a newer crowdsec against an old config key that was removed.","solutions":["Read the detail after 'cannot parse:' — it names the exact unknown field or YAML syntax problem.","Fix or remove the unknown/misspelled key; journalctl source supports fields like mode, since, log_level, and DataSourceCommonCfg fields.","Validate YAML syntax (indentation, quotes) with any YAML linter before restarting crowdsec.","Check 'cscli capi' / docs for the current supported config keys for the journalctl source."],"exampleFix":"// before (acquis.yaml)\nsource: journalctl\njournald_filters: _SYSTEMD_UNIT=sshd\n// after\nsource: journalctl\nfilters:\n  - _SYSTEMD_UNIT=sshd.service","handlingStrategy":"validation","validationCode":"// client-side pre-check before handing YAML to the source\nvar probe map[string]interface{}\nif err := yaml.Unmarshal(yamlCfg, &probe); err != nil {\n    return fmt.Errorf(\"invalid YAML: %w\", err)\n}\nallowed := map[string]bool{\"mode\": true, \"since\": true, \"log_level\": true, \"filters\": true}\nfor k := range probe {\n    if !allowed[k] {\n        return fmt.Errorf(\"unknown journalctl key: %s\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := source.UnmarshalConfig(cfg); err != nil {\n    if strings.HasPrefix(err.Error(), \"cannot parse:\") {\n        // log err and fall back to last-known-good config\n    }\n}","preventionTips":["Keep acquis.yaml under version control and review diffs","Validate YAML with a linter before deploying","Copy config keys only from the docs for your crowdsec version","Test config changes with cscli/crowdsec in a staging instance first"],"tags":["go","yaml","configuration","journalctl"],"backgroundTag":"yaml-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}