crowdsecurity/crowdsec · error

error decoding parsing configuration file '%s': %v

Error message

error decoding parsing configuration file '%s': %v

What it means

Wraps a YAML decoding error while parsing a parser stage file in processStageFile. The file opened fine, but the strict-mode YAML decoder rejected its content (syntax error, unknown field, duplicate key, bad type). CrowdSec refuses to load a node it cannot decode rather than silently skipping it.

Source

Thrown at pkg/parser/stage.go:107

	// process the yaml
	dec := yaml.NewDecoder(yamlFile)
	dec.SetStrict(true)

	var nodes []Node

	nodesCount := 0

	for {
		node := Node{}
		node.OnSuccess = "continue" // default behavior is to continue

		if err = dec.Decode(&node); err != nil {
			if errors.Is(err, io.EOF) {
				log.Tracef("End of yaml file")
				break
			}

			return nil, fmt.Errorf("error decoding parsing configuration file '%s': %v", stageFile.Filename, err)
		}

		// check for empty bucket
		if node.Name == "" && node.Description == "" && node.Author == "" {
			log.Infof("Node in %s has no name, author or description. Skipping.", stageFile.Filename)
			continue
		}

		// check compat
		if node.FormatVersion == "" {
			log.Tracef("no version in %s, assuming '1.0'", node.Name)
			node.FormatVersion = "1.0"
		}

		ok, err := constraint.Satisfies(node.FormatVersion, constraint.Parser)
		if err != nil {
			return nil, fmt.Errorf("failed to check version : %s", err)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %v — yaml errors include the line/column of the problem
2. Validate the YAML with a linter (`yamllint`) fixing tabs, indentation, and quoting
3. Remove unknown top-level keys not in the Node schema (strict mode rejects them)
4. Compare against the hub's upstream version of the file: `cscli hub upgrade`

Example fix

# before (tab indentation → yaml error)
filter:	'evt.Parsed.foo == "bar"'
# after (spaces)
filter: 'evt.Parsed.foo == "bar"'

// strict-decode the file before installing it
f, _ := os.Open(path)
dec := yaml.NewDecoder(f)
dec.SetStrict(true)
var n parser.Node
if err := dec.Decode(&n); err != nil && !errors.Is(err, io.EOF) {
    return fmt.Errorf("invalid parser yaml %s: %w", path, err)
}

if _, err := processStageFile(sf, pctx, ectx); err != nil {
    log.Errorf("yaml invalid: %v", err) // err message contains line/col
}

When it happens

Trigger: Calling processStageFile (via LoadStages) when dec.Decode(&node) returns a non-EOF error: malformed YAML syntax, tabs for indentation, unknown keys (strict decoding is enabled), wrong types for node fields.

Common situations: Hand-edited parser files with tab indentation or missing spaces, copy-pasted YAML with smart quotes, parser format updates adding fields that clash with local overrides, concatenated YAML documents with a stray '---'.

Related errors

• stash %d: %w
• failed to load parser config: %w
• failed to load postoverflow config: %w
• empty file
• while parsing DockerAcquisition configuration: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0f175d43f3ab7df3. Report an issue: GitHub.