crowdsecurity/crowdsec · error

timestamp is empty

Error message

timestamp is empty

What it means

parseTimestamp collects characters up to the next space as the timestamp, unless it sees the NIL_VALUE '-'. If the first character is a space (or the position already points at an immediate break with nothing collected), the timestamp is empty and the header is malformed per RFC 5424, which requires either '-' or an RFC 3339 timestamp.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:107

	timestamp := []byte{}

	if r.buf[r.position] == NIL_VALUE {
		r.Timestamp = time.Now().UTC().Round(0)
		r.position += 2
		return nil
	}

	for r.position < r.len {
		c := r.buf[r.position]
		if c == ' ' {
			break
		}
		timestamp = append(timestamp, c)
		r.position++
	}

	if len(timestamp) == 0 {
		return errors.New("timestamp is empty")
	}

	if r.position == r.len {
		return errors.New("EOL after timestamp")
	}

	date, err := time.Parse(VALID_TIMESTAMP, string(timestamp))
	if err != nil {
		return errors.New("timestamp is not valid")
	}

	r.Timestamp = date

	r.position++

	if r.position >= r.len {
		return errors.New("EOL after timestamp")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the sender template so exactly one space separates version and timestamp.
2. Replace the empty field with '-' (NILVALUE) if the sender has no timestamp.
3. Inspect the raw line for consecutive spaces after the version digit.

Example fix

// before (double space -> empty timestamp)
parser.Parse([]byte("<34>1  2024-01-01T00:00:00Z host app 1 - msg"))
// after
parser.Parse([]byte("<34>1 2024-01-01T00:00:00Z host app 1 - msg"))

// Go: ensure exactly one space after version, then a timestamp or '-'
re := regexp.MustCompile(`^<\d{1,3}>1 [^ ]`)
func headerOK(line []byte) bool { return re.Match(line) }

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "timestamp is empty") {
		// check sender template for a double space after version
	}
}

When it happens

Trigger: Calling RFC5424.Parse on a header with a double space after the version, e.g. "<34>1 host ..." — the first space ends collection immediately with zero bytes, producing this error (distinct from the NIL_VALUE '-' path which yields a synthetic now timestamp).

Common situations: A sender using a custom syslog template inserting an extra space, hand-crafted test messages, or a relay normalizing whitespace incorrectly.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• PRI must start with '<'
• PRI must be a number
• PRI must be up to 3 characters long
• PRI must end with '>'
• version must be 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b49faf0dda763f4f. Report an issue: GitHub.