crowdsecurity/crowdsec · error

expected zero or one argument for 'backlog'

Error message

expected zero or one argument for 'backlog'

What it means

DSN validation in ConfigureByDSN for the cloudwatch source: the backlog query parameter (how far back to read) was repeated. The guard requires exactly one value; a single duration is converted into StartTime/EndTime bounds.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:264

		case "start_date":
			if len(v) != 1 {
				return errors.New("expected zero or one argument for 'start_date'")
			}
			// let's reuse our parser helper so that a ton of date formats are supported
			strdate, startDate := parser.GenDateParse(v[0])
			s.logger.Debugf("parsed '%s' as '%s'", v[0], strdate)
			s.Config.StartTime = &startDate
		case "end_date":
			if len(v) != 1 {
				return errors.New("expected zero or one argument for 'end_date'")
			}
			// let's reuse our parser helper so that a ton of date formats are supported
			strdate, endDate := parser.GenDateParse(v[0])
			s.logger.Debugf("parsed '%s' as '%s'", v[0], strdate)
			s.Config.EndTime = &endDate
		case "backlog":
			if len(v) != 1 {
				return errors.New("expected zero or one argument for 'backlog'")
			}
			// let's reuse our parser helper so that a ton of date formats are supported
			duration, err := time.ParseDuration(v[0])
			if err != nil {
				return fmt.Errorf("unable to parse '%s' as duration: %w", v[0], err)
			}

			s.logger.Debugf("parsed '%s' as '%s'", v[0], duration)
			start := time.Now().UTC().Add(-duration)
			s.Config.StartTime = &start
			end := time.Now().UTC()
			s.Config.EndTime = &end
		default:
			return fmt.Errorf("unexpected argument %s", k)
		}
	}

	s.logger.Tracef("host=%s", s.Config.GroupName)

View on GitHub (pinned to 909b515798)

Solutions

1. Pass backlog once, e.g. backlog=1h
2. Prefer backlog over explicit start_date/end_date if you just want 'last N duration' semantics

When it happens

Trigger: Thrown at pkg/acquisition/modules/cloudwatch/config.go:264 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0e2e76d1a70e099d. Report an issue: GitHub.