crowdsecurity/crowdsec · error

could not parse s3 args: %w

Error message

could not parse s3 args: %w

What it means

After the bucket part, ConfigureByDSN parses the DSN's query string with url.ParseQuery to extract options like log_level. A malformed query — invalid percent-encoding or malformed key=value pairs — is wrapped as 'could not parse s3 args'.

Source

Thrown at pkg/acquisition/modules/s3/config.go:218

	}

	s.Config = Configuration{}
	s.logger = logger.WithFields(log.Fields{
		"bucket": s.Config.BucketName,
		"prefix": s.Config.Prefix,
	})

	dsn = strings.TrimPrefix(dsn, "s3://")
	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty s3:// DSN")
	}

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("could not parse s3 args: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'log_level'")
				}

				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("unknown level %s: %w", value[0], err)
				}

				s.logger.Logger.SetLevel(lvl)
			case "max_buffer_size":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'max_buffer_size'")

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the query string: use url.QueryEscape (or equivalent) to encode values, e.g. prefix=logs%2Fapp
2. Encode literal '%' as %25 and remove stray separators not forming key=value pairs
3. Join multiple options with & and ensure each is key=value
4. Pre-validate the DSN with url.ParseQuery in the code that builds it

Example fix

// before
"s3://my-bucket?prefix=logs%zz"
// after
"s3://my-bucket?prefix=logs%2Fapp"

parts := strings.SplitN(strings.TrimPrefix(dsn, "s3://"), "?", 2)
if len(parts) == 2 {
    if _, err := url.ParseQuery(parts[1]); err != nil {
        // reject/fix the DSN before ConfigureByDSN
    }
}

When it happens

Trigger: DSNs such as s3://bucket?prefix=logs%zz (invalid escape), s3://bucket?;; or s3://bucket?a=% where url.ParseQuery returns an error.

Common situations: Hand-rolled percent-encoding producing invalid escapes like %zz; literal '%' not encoded as %25; truncated or concatenated DSN strings in generated configs.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• query is mandatory (at least start_date and end_date or back
• cloudwatch path must contain group and stream : /my/group/na
• empty loki host
• too many arguments in DSN
• failed to parse DSN %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6eb6fa7f3da38201. Report an issue: GitHub.