crowdsecurity/crowdsec · error

unknown log_format %q

Error message

unknown log_format %q

What it means

SetupStandardLogger also validates the log format. After resolving the level it switches on cfg.GetFormat(); only 'text' (or empty, meaning default) and 'json' are supported. Any other value returns 'unknown log_format %q' and aborts logger setup. Like the log_mode error, this is a startup-time configuration validation failure.

Source

Thrown at pkg/logging/standard.go:48

	case "stdout":
		// noop
	default:
		return fmt.Errorf("unknown log_mode %q", cfg.GetMedia())
	}

	logrus.SetLevel(cmp.Or(level, defLogLevel))

	switch cfg.GetFormat() {
	case "text", "":
		logFormatter = &logrus.TextFormatter{
			TimestampFormat: time.RFC3339,
			FullTimestamp:   true,
			ForceColors:     forceColors,
		}
	case "json":
		logFormatter = &logrus.JSONFormatter{TimestampFormat: time.RFC3339}
	default:
		return fmt.Errorf("unknown log_format %q", cfg.GetFormat())
	}

	logrus.SetFormatter(logFormatter)

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Set log_format to 'text' or 'json' (or remove the key to use the default)
2. Check the quoted value in the error for the typo
3. Compare against the documented logging options for your crowdsec version
4. Restart and verify logs render in the chosen format

Example fix

// before (config.yaml)
common:
  log_format: logfmt
// after
common:
  log_format: json

# Pre-flight check:
# grep 'log_format' /etc/crowdsec/config.yaml
# valid values: text | json | (unset for default)

if err := logging.SetupStandardLogger(cfg); err != nil {
    return fmt.Errorf("invalid logging format: %w", err)
}

When it happens

Trigger: log_format in the logging config is set to something other than 'text', '', or 'json' — e.g. 'raw', 'logfmt', 'cli', or a value copied from another tool's config.

Common situations: Hand-edited config.yaml/dev.yaml; config management templates emitting invalid defaults; confusing crowdsec's log_format with another product's options.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unknown log_mode %q
• path must start with /
• on_challenge hooks are only valid in-band, not under outofba
• empty cti key
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6025f820bd7f70ec. Report an issue: GitHub.