crowdsecurity/crowdsec · error

while parsing %s: %w

Error message

while parsing %s: %w

What it means

ConfigureByDSN parses the query-string portion of a cloudwatch DSN (e.g. cloudwatch://...?log_group=...&stream=...). If url.ParseQuery rejects that portion (malformed percent-encoding, stray '%' or bad escapes), the source configuration fails with this wrapped error.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:222

	args := strings.Split(dsn, "?")
	if len(args) != 2 {
		return errors.New("query is mandatory (at least start_date and end_date or backlog)")
	}

	frags := strings.Split(args[0], ":")
	if len(frags) != 2 {
		return errors.New("cloudwatch path must contain group and stream : /my/group/name:stream/name")
	}

	s.Config.GroupName = frags[0]
	s.Config.StreamName = &frags[1]
	s.Config.Labels = labels
	s.Config.UniqueId = uuid

	u, err := url.ParseQuery(args[1])
	if err != nil {
		return fmt.Errorf("while parsing %s: %w", dsn, err)
	}

	for k, v := range u {
		switch k {
		case "log_level":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'log_level'")
			}

			lvl, err := log.ParseLevel(v[0])
			if err != nil {
				return fmt.Errorf("unknown level %s: %w", v[0], err)
			}

			s.logger.Logger.SetLevel(lvl)
		case "profile":
			if len(v) != 1 {
				return errors.New("expected zero or one value for 'profile'")

View on GitHub (pinned to 909b515798)

Solutions

1. Percent-encode special characters in DSN parameter values (use url.QueryEscape when building programmatically).
2. Fix typos in the DSN query string (stray %, unbalanced separators).
3. Simplify: remove problematic characters from labels/stream names, or use the full config-file form instead of a DSN.

Example fix

// before
cloudwatch://us-east-1/MyGroup?labels=100%done&stream=app
// after
cloudwatch://us-east-1/MyGroup?labels=100%25done&stream=app

if _, err := url.ParseQuery(queryPart); err != nil {
    return fmt.Errorf("malformed DSN query %q: %w", queryPart, err)
}

if err := ConfigureByDSN(ctx, src, dsn); err != nil {
    return fmt.Errorf("cannot configure cloudwatch from DSN %q: %w", dsn, err)
}

When it happens

Trigger: Calling ConfigureByDSN with a DSN whose args[1] is not a valid URL query string — raw '%' characters, unescaped '&=' misuse, or invalid percent escapes like '%zz'.

Common situations: Stream names or labels pasted into the DSN containing special characters that weren't percent-encoded, hand-written acquis.yaml DSNs with typos, or programmatically assembled DSNs skipping url.QueryEscape.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• query is mandatory (at least start_date and end_date or back
• cloudwatch path must contain group and stream : /my/group/na
• group_name is mandatory for CloudwatchSource
• aws_region is not specified, specify it or aws_config_dir
• can't read aws_config_dir %s got err %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/382d6cd057d347c2. Report an issue: GitHub.