invalid --event filter provided, please use one of the follo

Error message

invalid --event filter provided, please use one of the following EventTypes: cloudflared, http, tcp, udp

What it means

Validation error in parseFilters for `cloudflared tail`. It fires when any value passed to the repeatable --event flag does not parse as a management.LogEventType (valid: cloudflared, http, tcp, udp), aborting stream setup before the websocket connection is made.

Source

Thrown at cmd/cloudflared/tail/cmd.go:185

	events := make([]management.LogEventType, 0)

	argLevel := c.String("level")
	argEvents := c.StringSlice("event")
	argSample := c.Float64("sample")

	if argLevel != "" {
		l, ok := management.ParseLogLevel(argLevel)
		if !ok {
			return nil, fmt.Errorf("invalid --level filter provided, please use one of the following Log Levels: debug, info, warn, error")
		}
		level = &l
	}

	for _, v := range argEvents {
		t, ok := management.ParseLogEventType(v)
		if !ok {
			return nil, fmt.Errorf("invalid --event filter provided, please use one of the following EventTypes: cloudflared, http, tcp, udp")
		}
		events = append(events, t)
	}

	if argSample <= 0.0 || argSample > 1.0 {
		return nil, fmt.Errorf("invalid --sample value provided, please make sure it is in the range (0.0 .. 1.0)")
	}
	sample = argSample

	if level == nil && len(events) == 0 && argSample != 1.0 {
		// When no filters are provided, do not return a StreamingFilters struct
		return nil, nil
	}

	return &management.StreamingFilters{
		Level:    level,
		Events:   events,
		Sampling: sample,

View on GitHub (pinned to 2253eeeb25)

Solutions

Use only: cloudflared, http, tcp, udp
Repeat the flag for multiple events: --event http --event tcp
Check `cloudflared tail --help` for the exact accepted values

Example fix

# before
cloudflared tail --event quic <tunnel-id>
# after
cloudflared tail --event tcp --event udp <tunnel-id>

Defensive patterns

Strategy: validation

Validate before calling

var validEvents = map[string]bool{"cloudflared": true, "http": true, "tcp": true, "udp": true}
for _, e := range events {
	if !validEvents[strings.ToLower(e)] {
		return fmt.Errorf("--event %q invalid; use cloudflared, http, tcp, udp", e)
	}
}

Try / catch

if _, ok := management.ParseLogEventType(e); !ok {
	return usageError("invalid --event; expected cloudflared|http|tcp|udp")
}

Prevention

Only use the four documented event names
Repeat --event per type instead of comma lists unless supported
Keep a script-side whitelist of allowed event values

When it happens

Trigger: Running e.g. `cloudflared tail --event https <tunnel-id>` or `--event Cloudflared` if parsing is case-sensitive — any --event string not matching a defined LogEventType.

Common situations: Guessing event names (e.g. 'dns', 'quic'), pluralizing them ('events'), or wrong casing when passing multiple --event flags.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/7c2c4b82236143c1. Report an issue: GitHub.