crowdsecurity/crowdsec · error

failed to parse log_level: %s

Error message

failed to parse log_level: %s

What it means

The `log_level` DSN parameter must be a single value parseable by log.ParseLevel (e.g. debug, info, warn, error). This error is returned when the value fails ParseLevel, meaning it is not one of the recognized level strings.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:222

	}

	s.config.EventFile = args[0]

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("failed to parse DSN parameters: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("log_level must be a single value")
				}
				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("failed to parse log_level: %s", err)
				}
				s.logger.Logger.SetLevel(lvl)
			case "event_id":
				for _, id := range value {
					evtid, err := strconv.Atoi(id)
					if err != nil {
						return fmt.Errorf("failed to parse event_id: %s", err)
					}
					s.config.EventIDs = append(s.config.EventIDs, evtid)
				}
			case "event_level":
				if len(value) != 1 {
					return errors.New("event_level must be a single value")
				}
				s.config.EventLevel = value[0]
			}
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Use one of the accepted level strings: panic, fatal, error, warn, warning, info, debug, trace.
2. If you intended to filter Windows event severities, use the `event_level` parameter instead of `log_level`.
3. Remove whitespace and ensure only a single log_level value is present.
4. Example valid DSN: `wineventlog://System?log_level=debug`.

Example fix

// before
wineventlog://System?log_level=verbose
// after
wineventlog://System?log_level=debug

var validLevels = map[string]bool{"panic":true,"fatal":true,"error":true,"warn":true,"warning":true,"info":true,"debug":true,"trace":true}
if !validLevels[strings.ToLower(lvl)] { return fmt.Errorf("invalid log_level %q", lvl) }

When it happens

Trigger: A DSN like `wineventlog://System?log_level=verbose` — 'verbose' is not a valid level — or `log_level=DEBUG ` with stray whitespace/casing variants ParseLevel rejects. (log.ParseLevel is case-insensitive but does not accept unknown words.)

Common situations: Users confusing Windows event levels (verbose) with logrus levels (trace/debug/info/warn/error/fatal/panic), or specifying two values like `log_level=info,error`.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• log_level must be a single value
• unknown level %s: %w
• failed to parse DSN parameters: %w
• failed to parse event_id: %s
• query is mandatory (at least start_date and end_date or back

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8b2fd80298037366. Report an issue: GitHub.