What causes "unknown level %s: %w" in crowdsecurity/crowdsec?

Use one of the valid level names: panic, fatal, error, warn, warning, info, debug, trace.

unknown level %s: %w

Error message

unknown level %s: %w

What it means

ConfigureByDSN accepts DSN parameters like `log_level=debug`. When the value given for 'log_level' cannot be parsed by log.ParseLevel, it is rejected with this wrapped error. The library only accepts known logrus level names.

Source

Thrown at pkg/acquisition/modules/s3/config.go:230

		return errors.New("empty s3:// DSN")
	}

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("could not parse s3 args: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'log_level'")
				}

				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("unknown level %s: %w", value[0], err)
				}

				s.logger.Logger.SetLevel(lvl)
			case "max_buffer_size":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'max_buffer_size'")
				}

				maxBufferSize, err := strconv.Atoi(value[0])
				if err != nil {
					return fmt.Errorf("invalid value for 'max_buffer_size': %w", err)
				}

				s.logger.Debugf("Setting max buffer size to %d", maxBufferSize)
				s.Config.MaxBufferSize = maxBufferSize
			default:
				return fmt.Errorf("unknown parameter %s", key)
			}

View on GitHub (pinned to 909b515798)

Solutions

Use one of the valid level names: panic, fatal, error, warn, warning, info, debug, trace.
Check the DSN for typos in the value after log_level=.
Remove the log_level parameter entirely to use the default level.

Example fix

// before
crowdsec-s3://mybucket?log_level=verbose
// after
crowdsec-s3://mybucket?log_level=trace

Defensive patterns

Strategy: validation

Validate before calling

valid := map[string]bool{"panic":true,"fatal":true,"error":true,"warn":true,"warning":true,"info":true,"debug":true,"trace":true}
if !valid[level] { return fmt.Errorf("invalid log_level %q", level) }

Prevention

Keep a constant list of accepted level names next to DSN-building code.
Reuse log.ParseLevel yourself before composing the DSN.
Test acquisition DSNs with a config dry-run before deployment.

When it happens

Trigger: Calling ConfigureByDSN with a DSN containing log_level set to a string that is not a valid level (e.g. `log_level=verbose`, `log_level=warning` when `warn` is expected, or a typo like `log_lvel` value `degub`).

Common situations: Typos in acquisition config; users copying levels from other software that uses different naming (e.g. 'warn' vs 'warning', 'verbose'); uppercase-only expectations since ParseLevel is case-insensitive but 'info2' style values are not valid.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/911763b270bcecc3. Report an issue: GitHub.