crowdsecurity/crowdsec · error

expected zero or one value for 'log_level'

Error message

expected zero or one value for 'log_level'

What it means

DSN validation in S3 ConfigureByDSN: the log_level query parameter occurs more than once in the s3:// DSN. url.ParseQuery yields a multi-value slice for repeated keys and the guard accepts exactly one value.

Source

Thrown at pkg/acquisition/modules/s3/config.go:225

	dsn = strings.TrimPrefix(dsn, "s3://")
	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty s3:// DSN")
	}

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("could not parse s3 args: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'log_level'")
				}

				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("unknown level %s: %w", value[0], err)
				}

				s.logger.Logger.SetLevel(lvl)
			case "max_buffer_size":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'max_buffer_size'")
				}

				maxBufferSize, err := strconv.Atoi(value[0])
				if err != nil {
					return fmt.Errorf("invalid value for 'max_buffer_size': %w", err)
				}

View on GitHub (pinned to 909b515798)

Solutions

1. Specify log_level once, e.g. s3://my-bucket?log_level=info
2. Use canonical level names accepted by log.ParseLevel

When it happens

Trigger: Thrown at pkg/acquisition/modules/s3/config.go:225 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6885094f8083772c. Report an issue: GitHub.