crowdsecurity/crowdsec · error

nil message

Error message

nil message

What it means

Type guard in cwLogToEvent: the AWS CloudWatch Logs SDK returned an OutputLogEvent whose Message pointer is nil. Dereferencing it would panic, so the event is rejected before *log.Message is taken. It indicates a malformed/empty log entry from GetLogEvents, not a config problem.

Source

Thrown at pkg/acquisition/modules/cloudwatch/run.go:452

			}

			cfg.logger.Tracef("after GetLogEventsPagesWithContext")
		case <-s.t.Dying():
			cfg.logger.Warningf("cat stream killed")
			return nil
		}
	}

	cfg.logger.Tracef("CatLogStream out")

	return nil
}

func cwLogToEvent(log cwTypes.OutputLogEvent, cfg *LogStreamTailConfig) (pipeline.Event, error) {
	evt := pipeline.MakeEvent(cfg.ExpectMode == pipeline.TIMEMACHINE, pipeline.LOG, true)

	if log.Message == nil {
		return evt, errors.New("nil message")
	}

	msg := *log.Message
	if cfg.PrependCloudwatchTimestamp != nil && *cfg.PrependCloudwatchTimestamp {
		eventTimestamp := time.Unix(0, *log.Timestamp*int64(time.Millisecond))
		msg = eventTimestamp.String() + " " + msg
	}

	l := pipeline.Line{
		Raw: msg,
		Labels: cfg.Labels,
		Time: time.Now().UTC(),
		Src: cfg.GroupName + "/" + cfg.StreamName,
		Process: true,
		Module: ModuleName,
	}

	evt.Line = l

View on GitHub (pinned to 909b515798)

Solutions

1. Skip the event — the acquisition layer drops it rather than crashing the pipeline
2. If it recurs systematically, inspect the raw CloudWatch Logs stream for zero-length or corrupt entries
3. Check for SDK version mismatches with AWS event payloads

When it happens

Trigger: Thrown at pkg/acquisition/modules/cloudwatch/run.go:452 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8033e1de9c3431cf. Report an issue: GitHub.