crowdsecurity/crowdsec · error

unsupported key %s in journalctl DSN

Error message

unsupported key %s in journalctl DSN

What it means

The journalctl DSN query string only accepts the keys 'filters' and 'since' (plus log_level handling). Any other key present in the parsed query produces this error, since strict DSN parsing prevents silently ignored configuration.

Source

Thrown at pkg/acquisition/modules/journalctl/config.go:121

		case "log_level":
			if len(value) != 1 {
				return errors.New("expected exactly one value for 'log_level'")
			}

			lvl, err := log.ParseLevel(value[0])
			if err != nil {
				return err
			}

			logLevel = lvl
		case "since":
			if len(value) != 1 {
				return errors.New("expected exactly one value for 'since'")
			}

			since = value[0]
		default:
			return fmt.Errorf("unsupported key %s in journalctl DSN", key)
		}
	}

	s.config = Configuration{
		DataSourceCommonCfg: configuration.DataSourceCommonCfg{
			Mode:     configuration.CAT_MODE,
			Labels:   labels,
			UniqueId: uuid,
		},
		Filters: filters,
		since:   since,
	}

	s.setSrc(s.config.Filters)
	s.setLogger(logger, logLevel, s.src)

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Replace the unsupported key with a supported one: 'filters' (repeatable) or 'since'.
2. Express journalctl flags as filter matches, e.g. --unit=sshd becomes filters=_SYSTEMD_UNIT=sshd.service.
3. Set verbosity via the source's log_level config in YAML, not a DSN key, unless the documented key list allows it.
4. Check the journalctl acquisition docs for the exact supported DSN parameter list.

Example fix

// before
s.ConfigureByDSN("journalctl://unit=sshd.service")
// after
s.ConfigureByDSN("journalctl://filters=_SYSTEMD_UNIT=sshd.service")

params, err := url.ParseQuery(strings.TrimPrefix(dsn, "journalctl://"))
if err != nil { return err }
for k := range params {
    switch k {
    case "filters", "since":
    default:
        return fmt.Errorf("key %q is not supported; use filters or since", k)
    }
}

if err := src.ConfigureByDSN(dsn); err != nil {
    if strings.Contains(err.Error(), "unsupported key") {
        // rewrite DSN with documented keys and retry
    }
}

When it happens

Trigger: Calling ConfigureByDSN with e.g. 'journalctl://unit=sshd' or 'journalctl://filters=...&level=debug' — 'unit' and 'level' are unsupported key names.

Common situations: Users guessing key names from the systemd journalctl CLI flags (--unit, --level) instead of the documented DSN keys; mixing journalctl source config with journalctl command-line syntax.

Related errors

• invalid DSN %s for journalctl source, must start with journa
• cannot parse: %s
• empty journalctl:// DSN
• expected exactly one value for 'log_level'
• expected exactly one value for 'since'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2c7b82a1720b0290. Report an issue: GitHub.