crowdsecurity/crowdsec · error

unknown level %s: %w

Error message

unknown level %s: %w

What it means

The `log_level` DSN parameter is parsed with log.ParseLevel (logrus). If the value is not one of the recognized levels (panic, fatal, error, warn/warning, info, debug, trace), configuration fails with this wrapped error.

Source

Thrown at pkg/acquisition/modules/docker/config.go:252

	if containerNameOrID == "" {
		return fmt.Errorf("empty %s DSN", d.GetName()+"://")
	}

	d.Config.ContainerName = append(d.Config.ContainerName, containerNameOrID)
	// we add it as an ID also so user can provide docker name or docker ID
	d.Config.ContainerID = append(d.Config.ContainerID, containerNameOrID)

	parameters := parsedURL.Query()

	for k, v := range parameters {
		switch k {
		case "log_level":
			if len(v) != 1 {
				return errors.New("only one 'log_level' parameters is required, not many")
			}
			lvl, err := log.ParseLevel(v[0])
			if err != nil {
				return fmt.Errorf("unknown level %s: %w", v[0], err)
			}
			d.logger.Logger.SetLevel(lvl)
		case "until":
			if len(v) != 1 {
				return errors.New("only one 'until' parameters is required, not many")
			}
			d.containerLogsOptions.Until = v[0]
		case "since":
			if len(v) != 1 {
				return errors.New("only one 'since' parameters is required, not many")
			}
			d.containerLogsOptions.Since = v[0]
		case "follow_stdout":
			if len(v) != 1 {
				return errors.New("only one 'follow_stdout' parameters is required, not many")
			}
			followStdout, err := strconv.ParseBool(v[0])
			if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Use a logrus level name: panic, fatal, error, warn, info, debug, or trace.
2. Replace numeric levels with the matching name (e.g. 3 -> error).
3. Check for typos/extra characters in the parameter value.

Example fix

// before
docker://mycontainer?log_level=3
// after
docker://mycontainer?log_level=error

allowed := map[string]bool{"panic":true,"fatal":true,"error":true,"warn":true,"warning":true,"info":true,"debug":true,"trace":true}
if lvl := dsnQuery.Get("log_level"); lvl != "" && !allowed[strings.ToLower(lvl)] {
    return fmt.Errorf("log_level %q not a logrus level", lvl)
}

When it happens

Trigger: ConfigureByDSN encountering `?log_level=<value>` where log.ParseLevel(v[0]) fails — e.g. log_level=verbose, LOG (uppercase handled? no, ParseLevel is case-insensitive but misspellings are not), or a numeric level like 3.

Common situations: Users writing numeric syslog-style levels (0-7) or names like `verbose`/`warn_` in the DSN; copy-pasted log level from a different logging library with different level names.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• empty journalctl:// DSN
• empty loki host
• log_level must be a single value
• failed to parse DSN %s: %w
• invalid DSN %s for docker source, must start with %s://

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/97cb548b1115ba4e. Report an issue: GitHub.