crowdsecurity/crowdsec · error

cannot parse VictoriaLogs acquisition configuration: %s

Error message

cannot parse VictoriaLogs acquisition configuration: %s

What it means

UnmarshalConfig for the VictoriaLogs datasource failed to strict-parse the YAML stanza into the source configuration. With yaml.Strict(), any unknown or misspelled key causes an error; the message includes the yaml.FormattedError describing the exact offending field.

Source

Thrown at pkg/acquisition/modules/victorialogs/config.go:45

}

type Configuration struct {
	URL                               string              `yaml:"url"`    // VictoriaLogs url
	Prefix                            string              `yaml:"prefix"` // VictoriaLogs prefix
	Query                             string              `yaml:"query"`  // LogsQL query
	Limit                             int                 `yaml:"limit"`  // Limit of logs to read
	Since                             time.Duration       `yaml:"since"`
	Headers                           map[string]string   `yaml:"headers"`        // HTTP headers for talking to VictoriaLogs
	WaitForReady                      time.Duration       `yaml:"wait_for_ready"` // Retry interval, default is 10 seconds
	Auth                              AuthConfiguration `yaml:"auth"`
	MaxFailureDuration                time.Duration       `yaml:"max_failure_duration"` // Max duration of failure before stopping the source
	configuration.DataSourceCommonCfg `yaml:",inline"`
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	err := yaml.UnmarshalWithOptions(yamlConfig, &s.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse VictoriaLogs acquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.Config.URL == "" {
		return errors.New("VictoriaLogs url is mandatory")
	}

	if s.Config.Query == "" {
		return errors.New("VictoriaLogs query is mandatory")
	}

	if s.Config.WaitForReady == 0 {
		s.Config.WaitForReady = 10 * time.Second
	}

	if s.Config.Mode == "" {
		s.Config.Mode = configuration.TAIL_MODE
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error text — it names the unknown field or type mismatch; fix or remove that key.
2. Compare against the documented victorialogs fields: url, and DataSourceCommonCfg options (mode, labels, etc.).
3. Check indentation so unrelated keys are not inlined into this stanza.
4. Ensure required 'url' is present, since it is validated right after parsing.

Example fix

// before
source: victorialogs
url: http://vl:9428
typo_field: true   # unknown key -> strict parse error

// after
source: victorialogs
url: http://vl:9428

allowed := map[string]bool{"url": true, "mode": true, "labels": true, "log_level": true, "type": true, "name": true}
for key := range stanza {
    if !allowed[key] {
        return fmt.Errorf("unknown victorialogs field %q", key)
    }
}
if stanza["url"] == "" {
    return errors.New("url is required")
}

if err := yaml.UnmarshalWithOptions(b, &cfg, yaml.Strict()); err != nil {
    log.Errorf("bad victorialogs stanza: %s", yaml.FormatError(err, false, false))
    return err
}

When it happens

Trigger: A victorialogs acquisition stanza contains a field not in the Config struct (typo like 'urlrs', extra keys, wrong nesting), or a value with the wrong type (e.g. string where int expected).

Common situations: Copy-pasting an elasticsearch/Loki stanza and leaving stale keys; misspelling 'url', 'stream_fields', or 'mode'; version upgrades renaming a config key while the old key remains.

Related errors

• %s: %w
• error in %s: %w
• stash %d: %w
• path must start with /
• basic_auth is selected, but basic_auth is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b9212d60c13d5be7. Report an issue: GitHub.