crowdsecurity/crowdsec · error

expected zero or one value for 'log_level'

Error message

expected zero or one value for 'log_level'

What it means

DSN validation in file ConfigureByDSN: the log_level query parameter occurs more than once in the file:// DSN. url.ParseQuery produces a slice per key and the guard requires exactly one element before log.ParseLevel is applied.

Source

Thrown at pkg/acquisition/modules/file/config.go:177

	dsn = strings.TrimPrefix(dsn, "file://")

	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty file:// DSN")
	}

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("could not parse file args: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'log_level'")
				}

				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("unknown level %s: %w", value[0], err)
				}

				s.logger.Logger.SetLevel(lvl)
			case "max_buffer_size":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'max_buffer_size'")
				}

				maxBufferSize, err := strconv.Atoi(value[0])
				if err != nil {
					return fmt.Errorf("could not parse max_buffer_size %s: %w", value[0], err)
				}

View on GitHub (pinned to 909b515798)

Solutions

1. Give log_level a single occurrence, e.g. file:///var/log/app.log?log_level=info
2. Use valid level names: trace, debug, info, warn/warning, error, fatal, panic

When it happens

Trigger: Thrown at pkg/acquisition/modules/file/config.go:177 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6a7a1ee44feff04e. Report an issue: GitHub.