crowdsecurity/crowdsec · error

cannot parse: %s

Error message

cannot parse: %s

What it means

The journalctl acquisition source parses its YAML configuration with strict (unknown-field-rejecting) mode. If the YAML block for this source is not valid YAML or contains keys not present in the Configuration struct, the unmarshal fails and the error is wrapped as 'cannot parse: <detail>'. The detail from yaml.FormatError names the exact offending field or line.

Source

Thrown at pkg/acquisition/modules/journalctl/config.go:28

	yaml "github.com/goccy/go-yaml"
	log "github.com/sirupsen/logrus"

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
)

type Configuration struct {
	configuration.DataSourceCommonCfg `yaml:",inline"`

	Filters []string `yaml:"journalctl_filter"`
	since   string   // set only by DSN
}

func ConfigurationFromYAML(y []byte) (Configuration, error) {
	var cfg Configuration

	if err := yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()); err != nil {
		return cfg, fmt.Errorf("cannot parse: %s", yaml.FormatError(err, false, false))
	}

	cfg.SetDefaults()

	if err := cfg.Validate(); err != nil {
		return cfg, err
	}

	return cfg, nil
}

func (c *Configuration) SetDefaults() {
	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}
}

func (c *Configuration) Validate() error {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the detail after 'cannot parse:' — it names the exact unknown field or YAML syntax problem.
2. Fix or remove the unknown/misspelled key; journalctl source supports fields like mode, since, log_level, and DataSourceCommonCfg fields.
3. Validate YAML syntax (indentation, quotes) with any YAML linter before restarting crowdsec.
4. Check 'cscli capi' / docs for the current supported config keys for the journalctl source.

Example fix

// before (acquis.yaml)
source: journalctl
journald_filters: _SYSTEMD_UNIT=sshd
// after
source: journalctl
filters:
  - _SYSTEMD_UNIT=sshd.service

// client-side pre-check before handing YAML to the source
var probe map[string]interface{}
if err := yaml.Unmarshal(yamlCfg, &probe); err != nil {
    return fmt.Errorf("invalid YAML: %w", err)
}
allowed := map[string]bool{"mode": true, "since": true, "log_level": true, "filters": true}
for k := range probe {
    if !allowed[k] {
        return fmt.Errorf("unknown journalctl key: %s", k)
    }
}

if err := source.UnmarshalConfig(cfg); err != nil {
    if strings.HasPrefix(err.Error(), "cannot parse:") {
        // log err and fall back to last-known-good config
    }
}

When it happens

Trigger: Calling ConfigurationFromYAML (via UnmarshalConfig) with a YAML blob that has a typo'd or unknown key (e.g. 'journald:' instead of a known field), wrong type for a field, or syntactically invalid YAML.

Common situations: Users editing acquis.yaml add a field from an old or third-party example; indentation mistakes; quoting issues in filters; running a newer crowdsec against an old config key that was removed.

Related errors

• invalid DSN %s for journalctl source, must start with journa
• unsupported key %s in journalctl DSN
• cannot parse: %s
• no appsec_config provided
• VictoriaLogs url is mandatory

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/87e91935a0a51fdc. Report an issue: GitHub.