thanos-io/thanos · error

error while parsing tsdb selector configuration

Error message

error while parsing tsdb selector configuration

What it means

The query command converts the --store-selector-relabel-config (or --store.sd-relabel-config style) flag content into a YAML relabel config via storeSelectorRelabelConf.Content() and validates it against block.SelectorSupportedRelabelActions; invalid YAML or unsupported relabel actions produce "error while parsing tsdb selector configuration".

Solutions

1. Validate the YAML relabel config locally (promtool check config or yaml.Unmarshal into relabel.Config).
2. Ensure only selector-supported relabel actions are used; check block.SelectorSupportedRelabelActions for your version.
3. Quote multi-line flag values properly: use `--store-selector-relabel-config='<yaml>'` with newlines preserved.
4. Confirm each rule has valid source_labels, target_label, regex, and action fields.

Example fix

// before
--store-selector-relabel-config='{"action":"drop"}'  // JSON, missing regex/fields
// after
--store-selector-relabel-config='
- action: drop
  regex: "blacklisted.*"
  source_labels: [cluster]
'

conf, err := yamlContent.ToYAML() // and
if _, err := relabel.ParseFlags(relabelConf); err != nil {
    return fmt.Errorf("invalid store selector relabel config: %w", err)
}

if _, err := block.ParseRelabelConfig(content, block.SelectorSupportedRelabelActions); err != nil {
    return fmt.Errorf("unsupported selector relabel config: %w", err)
}

When it happens

Trigger: Supplying a relabel config string that is not valid YAML, or containing relabel actions not in SelectorSupportedRelabelActions (unsupported action types for store selection), when starting `thanos query`.

Common situations: Multi-line flag values mangled by the shell or Kubernetes args arrays, use of actions like `hashmod` with wrong modulus fields, or copy-pasted Prometheus relabel configs containing unsupported actions.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• parsing relabel configuration
• error while parsing config for request logging
• parse limit configuration
• error while parsing config for request logging
• validate relabel config

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/35d3c95c1be45bfe. Report an issue: GitHub.

Appendix: source

Thrown at cmd/thanos/query.go:261

			return errors.Wrap(err, "error while parsing config for request logging")
		}

		grpcLogOpts, logFilterMethods, err := logging.ParsegRPCOptions(reqLogConfig)
		if err != nil {
			return errors.Wrap(err, "error while parsing config for request logging")
		}

		if *webRoutePrefix == "" {
			*webRoutePrefix = *webExternalPrefix
		}

		if *webRoutePrefix != *webExternalPrefix {
			level.Warn(logger).Log("msg", "different values for --web.route-prefix and --web.external-prefix detected, web UI may not work without a reverse-proxy.")
		}

		tsdbRelabelConfig, err := storeSelectorRelabelConf.Content()
		if err != nil {
			return errors.Wrap(err, "error while parsing tsdb selector configuration")
		}
		tsdbSelector, err := block.ParseRelabelConfig(tsdbRelabelConfig, block.SelectorSupportedRelabelActions)
		if err != nil {
			return err
		}

		dialOpts, err := grpcClientConfig.dialOptions(logger, reg, tracer)
		if err != nil {
			return err
		}

		if grpcClientConfig.secure || grpcClientConfig.skipVerify || grpcClientConfig.cert != "" || grpcClientConfig.key != "" || grpcClientConfig.caCert != "" || grpcClientConfig.serverName != "" {
			level.Warn(logger).Log("msg", "--grpc-client-tls-* flags are deprecated and will be removed after v0.43.0, use default_client_config in endpoint.sd-config-file instead")
		}

		// remove this when the deprecated flags are removed, as the endpoint set will be the only way to configure store endpoints.
		globalTLSOpt, err := extgrpc.StoreClientTLSCredentials(logger, grpcClientConfig.secure, grpcClientConfig.skipVerify, grpcClientConfig.cert, grpcClientConfig.key, grpcClientConfig.caCert, grpcClientConfig.serverName, grpcClientConfig.minTLSVersion)
		if err != nil {

View on GitHub (pinned to 35b8b99117)