hashicorp/nomad · error

eventlog.level must be one of INFO, WARN, or ERROR

Error message

eventlog.level must be one of INFO, WARN, or ERROR

What it means

On Windows, the Eventlog telemetry/log sink accepts only the levels INFO, WARN, and ERROR, mapped via winsvc.EventlogFromString/EventlogLevelFromString. Validate() rejects any other string because the Windows event log API has no finer granularity for this integration.

Source

Thrown at command/agent/config.go:1587

	if b.Enabled {
		result.Enabled = b.Enabled
	}

	if b.Level != "" {
		result.Level = b.Level
	}

	return &result
}

// Validate validates the eventlog configuration
func (e *Eventlog) Validate() error {
	if e == nil {
		return nil
	}

	if winsvc.EventlogLevelFromString(e.Level) == winsvc.EVENTLOG_LEVEL_UNKNOWN {
		return errors.New("eventlog.level must be one of INFO, WARN, or ERROR")
	}

	return nil
}

// Ports encapsulates the various ports we bind to for network services. If any
// are not specified then the defaults are used instead.
type Ports struct {
	HTTP int `hcl:"http"`
	RPC  int `hcl:"rpc"`
	Serf int `hcl:"serf"`
	// ExtraKeysHCL is used by hcl to surface unexpected keys
	ExtraKeysHCL []string `hcl:",unusedKeys" json:"-"`
}

func (p *Ports) Copy() *Ports {
	if p == nil {
		return nil

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set `level` to exactly one of INFO, WARN, or ERROR (matching is via EventlogLevelFromString, so use the documented casing).
2. If you need DEBUG-level logging, configure it via the top-level log_level instead of the Windows eventlog sink.
3. Check for typos such as 'WARNING' where 'WARN' is expected.

Example fix

// before
eventlog {
  level = "debug"
}

// after
eventlog {
  level = "INFO"
}

allowed := map[string]bool{"INFO": true, "WARN": true, "ERROR": true}
if e := cfg.Eventlog; e != nil && !allowed[strings.ToUpper(e.Level)] {
    return fmt.Errorf("eventlog.level must be INFO, WARN, or ERROR, got %q", e.Level)
}

func eventlogLevelValid(l string) bool {
    switch l {
    case "INFO", "WARN", "ERROR":
        return true
    }
    return false
}

When it happens

Trigger: Config contains an `eventlog { level = ... }` block whose level string does not map to a known winsvc event-log level (e.g. "debug", "trace", "notice", or a typo like "warnning") when Eventlog.Validate() runs.

Common situations: Copying Unix log-level conventions (debug/trace) into the Windows eventlog block; case or spelling mistakes; assuming the generic log_level values apply to eventlog.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Failed to open Windows eventlog: %w
• EventLogger is not supported on this platform
• could not configure eventlog - %w
• could not remove eventlog configuration - %w
• Unknown log level

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0ce28d197660ef96. Report an issue: GitHub.