crowdsecurity/crowdsec · error

cannot parse: %s

Error message

cannot parse: %s

What it means

The kafka source unmarshals its YAML configuration in strict mode; invalid YAML or unknown/misspelled keys (e.g. 'broker' instead of 'brokers', 'topicn') produce this error wrapped as 'cannot parse: <detail>'. The detail names the exact problem field or syntax issue.

Source

Thrown at pkg/acquisition/modules/kafka/config.go:52

	ClientCert         string `yaml:"client_cert"`
	ClientKey          string `yaml:"client_key"`
	CaCert             string `yaml:"ca_cert"`
}

type KafkaBatchConfiguration struct {
	BatchMinBytes  int           `yaml:"min_bytes"`
	BatchMaxBytes  int           `yaml:"max_bytes"`
	BatchMaxWait   time.Duration `yaml:"max_wait"`
	BatchQueueSize int           `yaml:"queue_size"`
	CommitInterval time.Duration `yaml:"commit_interval"`
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.Config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse: %s", yaml.FormatError(err, false, false))
	}

	if len(s.Config.Brokers) == 0 {
		return fmt.Errorf("cannot create a %s reader with an empty list of broker addresses", s.GetName())
	}

	if s.Config.Topic == "" {
		return fmt.Errorf("cannot create a %s reader with an empty topic", s.GetName())
	}

	if s.Config.Mode == "" {
		s.Config.Mode = configuration.TAIL_MODE
	}

	s.logger.Debugf("successfully parsed kafka configuration : %+v", s.Config)

	return err
}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the detail after 'cannot parse:' to find the unknown field or syntax problem.
2. Use the documented kafka keys: brokers (list of host:port), topic, and optional timeout, balanced consumer group fields, etc.
3. Express brokers as a YAML list, not a single string.
4. Validate the YAML with a linter before restarting crowdsec.

Example fix

// before
source: kafka
brokers: kafka1:9092,kafka2:9092
// after
source: kafka
brokers:
  - kafka1:9092
  - kafka2:9092
topic: crowdsec

var probe map[string]interface{}
if err := yaml.Unmarshal(yamlCfg, &probe); err != nil {
    return fmt.Errorf("invalid kafka YAML: %w", err)
}
allowed := map[string]bool{"brokers": true, "topic": true, "mode": true, "timeout": true}
for k := range probe {
    if !allowed[k] { return fmt.Errorf("unknown kafka key: %s", k) }
}

if err := source.UnmarshalConfig(cfg); err != nil {
    if strings.HasPrefix(err.Error(), "cannot parse:") {
        // log detail, fall back to last-known-good config
    }
}

When it happens

Trigger: Calling Source.UnmarshalConfig with a kafka acquis YAML block containing an unknown key, wrong field type (e.g. brokers as a string instead of a list), or YAML syntax errors.

Common situations: Copying kafka config from another product with different key names; specifying brokers as a single comma-separated string instead of a YAML list; indentation or quoting mistakes.

Related errors

• cannot parse: %s
• cannot create a %s reader with an empty list of broker addre
• cannot create a %s reader with an empty topic
• no appsec_config provided
• VictoriaLogs url is mandatory

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/989738aec2090919. Report an issue: GitHub.