{"record":{"id":"8033e1de9c3431cf","repo":"crowdsecurity/crowdsec","slug":"nil-message","errorCode":null,"errorMessage":"nil message","messagePattern":"nil message","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/cloudwatch/run.go","lineNumber":452,"sourceCode":"\t\t\t}\n\n\t\t\tcfg.logger.Tracef(\"after GetLogEventsPagesWithContext\")\n\t\tcase <-s.t.Dying():\n\t\t\tcfg.logger.Warningf(\"cat stream killed\")\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tcfg.logger.Tracef(\"CatLogStream out\")\n\n\treturn nil\n}\n\nfunc cwLogToEvent(log cwTypes.OutputLogEvent, cfg *LogStreamTailConfig) (pipeline.Event, error) {\n\tevt := pipeline.MakeEvent(cfg.ExpectMode == pipeline.TIMEMACHINE, pipeline.LOG, true)\n\n\tif log.Message == nil {\n\t\treturn evt, errors.New(\"nil message\")\n\t}\n\n\tmsg := *log.Message\n\tif cfg.PrependCloudwatchTimestamp != nil && *cfg.PrependCloudwatchTimestamp {\n\t\teventTimestamp := time.Unix(0, *log.Timestamp*int64(time.Millisecond))\n\t\tmsg = eventTimestamp.String() + \" \" + msg\n\t}\n\n\tl := pipeline.Line{\n\t\tRaw: msg,\n\t\tLabels: cfg.Labels,\n\t\tTime: time.Now().UTC(),\n\t\tSrc: cfg.GroupName + \"/\" + cfg.StreamName,\n\t\tProcess: true,\n\t\tModule: ModuleName,\n\t}\n\n\tevt.Line = l","sourceCodeStart":434,"sourceCodeEnd":470,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/cloudwatch/run.go#L434-L470","documentation":"Type guard in cwLogToEvent: the AWS CloudWatch Logs SDK returned an OutputLogEvent whose Message pointer is nil. Dereferencing it would panic, so the event is rejected before *log.Message is taken. It indicates a malformed/empty log entry from GetLogEvents, not a config problem.","triggerScenarios":"Thrown at pkg/acquisition/modules/cloudwatch/run.go:452 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Skip the event — the acquisition layer drops it rather than crashing the pipeline","If it recurs systematically, inspect the raw CloudWatch Logs stream for zero-length or corrupt entries","Check for SDK version mismatches with AWS event payloads"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}