crowdsecurity/crowdsec · error

unknown level %s: %w

Error message

unknown level %s: %w

What it means

ConfigureByDSN parses the `log_level` DSN parameter with logrus' log.ParseLevel. If the value is not a valid level string (panic, fatal, error, warn, info, debug, trace), ParseLevel fails and the error is wrapped as `unknown level <value>: <underlying error>`. This is a configuration validation error: the datasource is not configured and acquisition aborts.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:234

	s.Config.StreamName = &frags[1]
	s.Config.Labels = labels
	s.Config.UniqueId = uuid

	u, err := url.ParseQuery(args[1])
	if err != nil {
		return fmt.Errorf("while parsing %s: %w", dsn, err)
	}

	for k, v := range u {
		switch k {
		case "log_level":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'log_level'")
			}

			lvl, err := log.ParseLevel(v[0])
			if err != nil {
				return fmt.Errorf("unknown level %s: %w", v[0], err)
			}

			s.logger.Logger.SetLevel(lvl)
		case "profile":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'profile'")
			}

			awsprof := v[0]
			s.Config.AwsProfile = &awsprof
			s.logger.Debugf("profile set to '%s'", *s.Config.AwsProfile)
		case "start_date":
			if len(v) != 1 {
				return errors.New("expected zero or one argument for 'start_date'")
			}
			// let's reuse our parser helper so that a ton of date formats are supported
			strdate, startDate := parser.GenDateParse(v[0])
			s.logger.Debugf("parsed '%s' as '%s'", v[0], strdate)

View on GitHub (pinned to 909b515798)

Solutions

1. Use a valid logrus level: panic, fatal, error, warn, info, debug or trace
2. Check the exact value in the acquisition config DSN for typos or whitespace
3. Omit the log_level parameter entirely to keep the default level

Example fix

// before
cloudwatch://my-group?log_level=verbose
// after
cloudwatch://my-group?log_level=debug

level := "debug"
if _, err := log.ParseLevel(level); err != nil {
    return fmt.Errorf("invalid log_level %q: use panic|fatal|error|warn|info|debug|trace", level)
}

err := ds.ConfigureByDSN(ctx, dsn)
var cfgErr *configError
if errors.As(err, &cfgErr) { /* fix DSN and reload config */ }

When it happens

Trigger: Calling ConfigureByDSN with a DSN containing `log_level=verbose` or any misspelled/unrecognized level value, e.g. cloudwatch://group?log_level=verbose. Also triggered by empty or malformed values passed after the parameter name.

Common situations: Typo in a LogQL/logrus level name; copying levels from a different logging library (e.g. 'warn' vs 'warning' — logrus accepts 'warn' but not 'warning'); user assuming arbitrary verbosity strings are valid.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unable to parse '%s' as duration: %w
• unexpected argument %s
• failed to load aws config: %w
• group_name is mandatory for CloudwatchSource
• aws_region is not specified, specify it or aws_config_dir

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/50479c2ce9d63fdc. Report an issue: GitHub.