{"record":{"id":"90825d9c97b625cb","repo":"crowdsecurity/crowdsec","slug":"structured-data-must-start-with-or-be","errorCode":null,"errorMessage":"structured data must start with '[' or be '-'","messagePattern":"structured data must start with '\\[' or be '-'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":256,"sourceCode":"\t\treturn errors.New(\"msgid is empty\")\n\t}\n\n\tif len(msgid) > 32 {\n\t\treturn errors.New(\"msgid is too long\")\n\t}\n\n\tr.MsgID = string(msgid)\n\treturn nil\n}\n\nfunc (r *RFC5424) parseStructuredData() error {\n\tdone := false\n\tif r.buf[r.position] == NIL_VALUE {\n\t\tr.position += 2\n\t\treturn nil\n\t}\n\tif r.buf[r.position] != '[' {\n\t\treturn errors.New(\"structured data must start with '[' or be '-'\")\n\t}\n\tprev := byte(0)\n\tfor r.position < r.len {\n\t\tdone = false\n\t\tc := r.buf[r.position]\n\t\tif c == ']' && prev != '\\\\' {\n\t\t\tdone = true\n\t\t\tr.position++\n\t\t\tif r.position < r.len && r.buf[r.position] == ' ' {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tprev = c\n\t\tr.position++\n\t}\n\tr.position++\n\tif !done {\n\t\treturn errors.New(\"structured data must end with ']'\")","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L238-L274","documentation":"Returned by parseStructuredData when the STRUCTURED-DATA element is neither the NIL value '-' nor begins with '[' as RFC5424 requires. The first byte at the parse position after MSGID is some other character.","triggerScenarios":"Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:256 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Emit '-' when the message has no structured data","Start every STRUCTURED-DATA element with '[' and properly close it with ']'","Verify the MSGID field before it is correctly terminated by a single space"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}