crowdsecurity/crowdsec · error

event_level must be a single value

Error message

event_level must be a single value

What it means

In the DSN query string, the 'event_level' parameter must appear exactly once. Because url.ParseQuery collects repeated keys into a slice, multiple event_level entries cannot be mapped to a single EventLevel config value and are rejected.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:235

				if len(value) != 1 {
					return errors.New("log_level must be a single value")
				}
				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("failed to parse log_level: %s", err)
				}
				s.logger.Logger.SetLevel(lvl)
			case "event_id":
				for _, id := range value {
					evtid, err := strconv.Atoi(id)
					if err != nil {
						return fmt.Errorf("failed to parse event_id: %s", err)
					}
					s.config.EventIDs = append(s.config.EventIDs, evtid)
				}
			case "event_level":
				if len(value) != 1 {
					return errors.New("event_level must be a single value")
				}
				s.config.EventLevel = value[0]
			}
		}
	}

	var err error

	// FIXME: handle custom xpath query
	s.query, err = s.buildXpathQuery()
	if err != nil {
		return fmt.Errorf("buildXpathQuery failed: %w", err)
	}

	s.logger.Debugf("query: %s\n", s.query)

	s.evtConfig, err = s.generateConfig(s.query, false)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Specify a single event_level value in the DSN
2. To filter multiple levels, use event_level with a comma-separated value or an xpath_query instead, per the module's supported syntax
3. Deduplicate parameters when building the DSN programmatically

Example fix

// before
wineventlog://Security?event_level=error&event_level=warning
// after
wineventlog://Security?event_level=error,warning

// Go: ensure a single event_level value before building the DSN
params := url.Values{}
params.Set("event_level", "error,warning") // one key, combined value

if err := src.ConfigureByDSN(dsn); err != nil {
    return fmt.Errorf("bad wineventlog DSN params: %w", err)
}

When it happens

Trigger: ConfigureByDSN with a DSN like wineventlog://Security?event_level=error&event_level=warning — the event_level key occurs more than once in the query string.

Common situations: Attempting to subscribe to multiple levels via repeated parameters; templated DSNs that append event_level unconditionally even when already present; copy-paste duplication when editing a DSN.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value
• event_channel or xpath_query must be set
• windows event log acquisition is only supported on Windows

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/927f83c5803e5bd5. Report an issue: GitHub.