crowdsecurity/crowdsec · error

message is empty

Error message

message is empty

What it means

Returned by parseMessage when the parser position already equals the message length — the syslog line ends right after the structured-data element (or a preceding field consumed the whole buffer), leaving no MSG part.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:281

			done = true
			r.position++
			if r.position < r.len && r.buf[r.position] == ' ' {
				break
			}
		}
		prev = c
		r.position++
	}
	r.position++
	if !done {
		return errors.New("structured data must end with ']'")
	}
	return nil
}

func (r *RFC5424) parseMessage() error {
	if r.position == r.len {
		return errors.New("message is empty")
	}

	message := []byte{}

	for r.position < r.len {
		c := r.buf[r.position]
		message = append(message, c)
		r.position++
	}
	r.Message = string(message)
	return nil
}

func (r *RFC5424) Parse(message []byte) error {
	r.len = len(message)
	if r.len == 0 {
		return errors.New("syslog line is empty")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Append a BOM and the message body after the structured-data element
2. If the empty message is legitimate per RFC5424, note that this parser still requires at least one trailing byte — send the NIL '-' or any content

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:281 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/04412bf14f0947de. Report an issue: GitHub.