crowdsecurity/crowdsec · error

expected zero or one value for 'log_level'

Error message

expected zero or one value for 'log_level'

What it means

DSN validation in ConfigureByDSN for the cloudwatch source: the log_level query parameter appeared more than once in the DSN (e.g. ...?log_level=info&log_level=debug). url.ParseQuery collects repeated keys as a slice, and the switch guard requires exactly one value so the intended level is unambiguous.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:229

	if len(frags) != 2 {
		return errors.New("cloudwatch path must contain group and stream : /my/group/name:stream/name")
	}

	s.Config.GroupName = frags[0]
	s.Config.StreamName = &frags[1]
	s.Config.Labels = labels
	s.Config.UniqueId = uuid

	u, err := url.ParseQuery(args[1])
	if err != nil {
		return fmt.Errorf("while parsing %s: %w", dsn, err)
	}

	for k, v := range u {
		switch k {
		case "log_level":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'log_level'")
			}

			lvl, err := log.ParseLevel(v[0])
			if err != nil {
				return fmt.Errorf("unknown level %s: %w", v[0], err)
			}

			s.logger.Logger.SetLevel(lvl)
		case "profile":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'profile'")
			}

			awsprof := v[0]
			s.Config.AwsProfile = &awsprof
			s.logger.Debugf("profile set to '%s'", *s.Config.AwsProfile)
		case "start_date":
			if len(v) != 1 {

View on GitHub (pinned to 909b515798)

Solutions

1. Provide log_level at most once in the cloudwatch DSN query string
2. Build DSNs with url.Values.Set (not Add) to guarantee single-valued parameters

When it happens

Trigger: Thrown at pkg/acquisition/modules/cloudwatch/config.go:229 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2281cc29a5d4bc7d. Report an issue: GitHub.