crowdsecurity/crowdsec · error

cannot parse FileAcquisition configuration: %s

Error message

cannot parse FileAcquisition configuration: %s

What it means

UnmarshalConfig for the file datasource parses the acquisition YAML with goccy/go-yaml in Strict() mode, so unknown keys or type mismatches produce a parse error, wrapped as "cannot parse FileAcquisition configuration". It fires on any malformed or schema-invalid file-source configuration block, before any file is opened.

Source

Thrown at pkg/acquisition/modules/file/config.go:40

type Configuration struct {
	Filenames                         []string
	ExcludeRegexps                    []string `yaml:"exclude_regexps"`
	Filename                          string
	ForceInotify                      bool          `yaml:"force_inotify"`
	MaxBufferSize                     int           `yaml:"max_buffer_size"`
	PollWithoutInotify                *bool         `yaml:"poll_without_inotify"`
	DiscoveryPollEnable               bool          `yaml:"discovery_poll_enable"`
	DiscoveryPollInterval             time.Duration `yaml:"discovery_poll_interval"`
	configuration.DataSourceCommonCfg `yaml:",inline"`
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse FileAcquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.logger != nil {
		s.logger.Tracef("FileAcquisition configuration: %+v", s.config)
	}

	if s.config.Filename != "" {
		s.config.Filenames = append(s.config.Filenames, s.config.Filename)
	}

	if len(s.config.Filenames) == 0 {
		return errors.New("no filename or filenames configuration provided")
	}

	if s.config.Mode == "" {
		s.config.Mode = configuration.TAIL_MODE
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error: it names the offending key/line — fix that key's spelling or value type.
2. Only use file-source keys: filenames/filename, mode, exclude_regexps, force_inotify, max_buffer_size, poll_without_inotify, discovery_poll_enable, discovery_poll_interval, plus labels/log_level/etc.
3. Validate YAML syntax (tabs are illegal in YAML — use spaces).
4. Test with `cscli` or crowdsec startup in dry-run to confirm the block parses before deploying.

Example fix

// before
source: file
filename: /var/log/auth.log
container_name: foo   # unknown key -> strict YAML error
// after
source: file
filename: /var/log/auth.log

// Go: strict-parse the config before handing it to the source
var probe fileacquisition.Configuration
if err := yaml.UnmarshalWithOptions(cfgYAML, &probe, yaml.Strict()); err != nil {
	return fmt.Errorf("invalid file acquisition YAML: %s", err)
}

if err := src.UnmarshalConfig(cfgYAML); err != nil {
	// the wrapped message names the offending key/line; log and abort startup
	log.Fatalf("file source config invalid: %v", err)
}

When it happens

Trigger: Any YAML unmarshal failure into the file Configuration struct: a misspelled key (strict mode rejects unknown fields), wrong value type (e.g. max_buffer_size: "abc"), bad indentation, or tabs in YAML.

Common situations: Copy-pasted config with wrong indentation; using keys from another datasource (e.g. docker's container_name) in a file source; durations given as bare numbers; stray tab characters in acquis.yaml.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• empty file
• while parsing DockerAcquisition configuration: %s
• unsupported mode %s for file source
• could not compile regexp %s: %w
• cannot parse: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/32ff02e33f422dd5. Report an issue: GitHub.