crowdsecurity/crowdsec · error

cannot parse: %s

Error message

cannot parse: %s

What it means

ConfigurationFromYAML unmarshals the syslog acquisition config with yaml.Strict(), so unknown fields or type mismatches are errors. The strict-mode yaml error is formatted and returned as 'cannot parse: ...'.

Source

Thrown at pkg/acquisition/modules/syslog/config.go:28

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
)

type Configuration struct {
	Proto                             string `yaml:"protocol,omitempty"`
	Port                              int    `yaml:"listen_port,omitempty"`
	Addr                              string `yaml:"listen_addr,omitempty"`
	MaxMessageLen                     int    `yaml:"max_message_len,omitempty"`
	DisableRFCParser                  bool   `yaml:"disable_rfc_parser,omitempty"` // if true, we don't try to be smart and just remove the PRI
	configuration.DataSourceCommonCfg `yaml:",inline"`
}

func ConfigurationFromYAML(y []byte) (Configuration, error) {
	var cfg Configuration

	if err := yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()); err != nil {
		return cfg, fmt.Errorf("cannot parse: %s", yaml.FormatError(err, false, false))
	}

	cfg.SetDefaults()

	if err := cfg.Validate(); err != nil {
		return cfg, err
	}

	return cfg, nil
}

func (c *Configuration) SetDefaults() {
	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}

	if c.Addr == "" {
		c.Addr = "127.0.0.1" // do we want a usable or secure default ?

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error after 'cannot parse:' — it names the unknown field or type mismatch and its line.
2. Remove or correct the unknown/mistyped field in the YAML.
3. Cross-check against the syslog source's documented configuration keys.
4. Use spaces, not tabs, and verify indentation depth.

Example fix

// before
source: syslog
maxden: 10
// after
source: syslog
max_denied: 10

var cfg map[string]interface{}
if err := yaml.Unmarshal(y, &cfg); err != nil {
    return err
}
allowed := map[string]bool{"source":true,"protocol":true,"listen_addr":true,"port":true /* ... */}
for k := range cfg {
    if !allowed[k] { return fmt.Errorf("unknown syslog config key %q", k) }
}

cfg, err := syslog.ConfigurationFromYAML(data)
if err != nil {
    return fmt.Errorf("syslog acquisition config rejected: %w", err)
}

When it happens

Trigger: Loading a syslog source config whose YAML contains keys not defined in the Configuration struct (e.g. a misspelled field like `maxden` instead of `max_denied`), wrong indentation, or a value of the wrong type.

Common situations: Hand-edited acquis.yaml with typos; copying config fields from other data sources (e.g. journalctl-specific options); upgrading crowdsec after a field was renamed; tabs instead of spaces.

Related errors

• no appsec_config provided
• unrecognized syslog message
• VictoriaLogs url is mandatory
• VictoriaLogs query is mandatory
• cannot parse: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/014e4d899d9eb0f1. Report an issue: GitHub.