crowdsecurity/crowdsec · error

structured data must end with ']'

Error message

structured data must end with ']'

What it means

Returned by parseStructuredData when the end of the buffer is reached without finding an unescaped ']' closing the STRUCTURED-DATA element — the SD token is truncated or its closing bracket is missing/escaped.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:274

		return errors.New("structured data must start with '[' or be '-'")
	}
	prev := byte(0)
	for r.position < r.len {
		done = false
		c := r.buf[r.position]
		if c == ']' && prev != '\\' {
			done = true
			r.position++
			if r.position < r.len && r.buf[r.position] == ' ' {
				break
			}
		}
		prev = c
		r.position++
	}
	r.position++
	if !done {
		return errors.New("structured data must end with ']'")
	}
	return nil
}

func (r *RFC5424) parseMessage() error {
	if r.position == r.len {
		return errors.New("message is empty")
	}

	message := []byte{}

	for r.position < r.len {
		c := r.buf[r.position]
		message = append(message, c)
		r.position++
	}
	r.Message = string(message)
	return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Close every STRUCTURED-DATA element with an unescaped ']'
2. Escape ']' inside param values as '\]' per RFC5424
3. Check the message wasn't truncated in transit before reaching the parser

When it happens

Trigger: Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:274 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c0639971c29a32d3. Report an issue: GitHub.