crowdsecurity/crowdsec · error

cannot parse: %s

Error message

cannot parse: %s

What it means

ConfigurationFromYAML parses a kinesis acquisition config with goccy/go-yaml in Strict() mode and returns any unmarshal error formatted via yaml.FormatError. Strict mode rejects unknown keys and type mismatches, so this fires on malformed or misspelled kinesis datasource yaml.

Source

Thrown at pkg/acquisition/modules/kinesis/config.go:38

type Configuration struct {
	configuration.DataSourceCommonCfg `yaml:",inline"`

	StreamName        string  `yaml:"stream_name"`
	StreamARN         string  `yaml:"stream_arn"`
	UseEnhancedFanOut bool    `yaml:"use_enhanced_fanout"` // Use RegisterStreamConsumer and SubscribeToShard instead of GetRecords
	AwsProfile        *string `yaml:"aws_profile"`
	AwsRegion         string  `yaml:"aws_region"`
	AwsEndpoint       string  `yaml:"aws_endpoint"`
	ConsumerName      string  `yaml:"consumer_name"`
	FromSubscription  bool    `yaml:"from_subscription"`
	MaxRetries        int     `yaml:"max_retries"`
}

func ConfigurationFromYAML(y []byte) (Configuration, error) {
	var cfg Configuration

	if err := yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()); err != nil {
		return cfg, fmt.Errorf("cannot parse: %s", yaml.FormatError(err, false, false))
	}

	cfg.SetDefaults()
	cfg.Normalize()

	err := cfg.Validate()
	if err != nil {
		return cfg, err
	}

	return cfg, nil
}

func (c *Configuration) SetDefaults() {
	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}
}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error text — goccy FormatError includes line/column of the offending key
2. Fix the unknown key or value type; check the Configuration struct fields in pkg/acquisition/modules/kinesis/config.go for exact key names
3. Validate yaml indentation (spaces, not tabs) and overall syntax with a linter
4. Keep only supported keys: stream_name, stream_arn, use_enhanced_fanout, aws_profile, aws_region, aws_endpoint, consumer_name, from_subscription, max_retries plus common datasource fields

Example fix

// before
source: kinesis
stream-name: my-stream   # unknown key in strict mode
// after
source: kinesis
stream_name: my-stream

allowed := map[string]bool{"stream_name":true,"stream_arn":true,"use_enhanced_fanout":true,"aws_profile":true,"aws_region":true,"aws_endpoint":true,"consumer_name":true,"from_subscription":true,"max_retries":true}
for k := range rawYamlKeys {
    if !allowed[k] { return fmt.Errorf("unknown kinesis key: %s", k) }
}

cfg, err := kinesisacquisition.ConfigurationFromYAML(y)
if err != nil {
    // goccy FormatError embeds line:col — surface it directly to the operator
    return fmt.Errorf("kinesis acquisition yaml: %v", err)
}

When it happens

Trigger: yaml.UnmarshalWithOptions(y, &cfg, yaml.Strict()) fails: a key not present in the kinesis Configuration struct (typo like `stream-name` vs `stream_name`, or stray keys), wrong value types (e.g. max_retries: "ten"), or invalid yaml syntax.

Common situations: Hand-editing /etc/crowdsec/acquis.d/*.yaml with typos; copy-pasting config with tabs instead of spaces; using kafka-style keys (brokers/topic) in a kinesis source; duration strings for int fields.

Related errors

• cannot create kinesis client: %w
• failed to parse api client credential configuration file '%s
• failed to parse %s: %w
• failed to load parser config: %w
• failed to load postoverflow config: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/90d6e4ddbb028f27. Report an issue: GitHub.