crowdsecurity/crowdsec · error

unexpected argument %s

Error message

unexpected argument %s

What it means

ConfigureByDSN iterates all DSN parameters and only knows a fixed set (aws_region, log_group, log_stream, log_level, profile, backlog, etc.). Any unrecognized parameter key hits the default branch and returns `unexpected argument <key>`, rejecting the whole datasource configuration. It guards against silently ignoring misspelled options.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:278

			s.logger.Debugf("parsed '%s' as '%s'", v[0], strdate)
			s.Config.EndTime = &endDate
		case "backlog":
			if len(v) != 1 {
				return errors.New("expected zero or one argument for 'backlog'")
			}
			// let's reuse our parser helper so that a ton of date formats are supported
			duration, err := time.ParseDuration(v[0])
			if err != nil {
				return fmt.Errorf("unable to parse '%s' as duration: %w", v[0], err)
			}

			s.logger.Debugf("parsed '%s' as '%s'", v[0], duration)
			start := time.Now().UTC().Add(-duration)
			s.Config.StartTime = &start
			end := time.Now().UTC()
			s.Config.EndTime = &end
		default:
			return fmt.Errorf("unexpected argument %s", k)
		}
	}

	s.logger.Tracef("host=%s", s.Config.GroupName)
	s.logger.Tracef("stream=%s", *s.Config.StreamName)
	s.Config.GetLogEventsPagesLimit = &def_GetLogEventsPagesLimit

	if err := s.newClient(ctx); err != nil {
		return err
	}

	if s.Config.StreamName == nil || s.Config.GroupName == "" {
		return errors.New("missing stream or group name")
	}

	if s.Config.StartTime == nil || s.Config.EndTime == nil {
		return errors.New("start_date and end_date or backlog are mandatory in one-shot mode")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Remove or correct the unknown parameter in the DSN
2. Check the cloudwatch datasource documentation for the exact supported parameter names
3. Use aws_region (not region), log_group (not group), log_stream (not stream) if those were the intended keys

Example fix

// before
cloudwatch://my-group?stream_name=s1&region=us-east-1
// after
cloudwatch://my-group?log_stream=s1&aws_region=us-east-1

allowed := map[string]bool{"aws_region":true,"log_group":true,"log_stream":true,"log_level":true,"profile":true,"backlog":true,"aws_arn":true,"to_file":true}
for k := range params {
    if !allowed[k] { return fmt.Errorf("unsupported cloudwatch DSN param %q", k) }
}

if err := ds.ConfigureByDSN(ctx, dsn); err != nil {
    if strings.HasPrefix(err.Error(), "unexpected argument") { /* strip/rename the bad key */ }
}

When it happens

Trigger: ConfigureByDSN called with a DSN containing a key not in the switch, e.g. `cloudwatch://group?stream_name=foo` (correct key is log_stream) or any typo like `region=` instead of `aws_region=`.

Common situations: Typos in parameter names, guessing parameter names instead of reading the datasource docs, copying DSN options between different acquisition modules (e.g. docker options used on cloudwatch).

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• unknown level %s: %w
• unable to parse '%s' as duration: %w
• failed to load aws config: %w
• group_name is mandatory for CloudwatchSource
• aws_region is not specified, specify it or aws_config_dir

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/aac87270051e4583. Report an issue: GitHub.