crowdsecurity/crowdsec · error

timestamp is not valid

Error message

timestamp is not valid

What it means

The collected timestamp is parsed with time.Parse using RFC 3339 with nanoseconds (time.RFC3339Nano). If the string doesn't match that layout — wrong format, missing timezone offset, or out-of-range components — the parser replaces the underlying error with this generic message and rejects the line.

Source

Thrown at pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go:116

		c := r.buf[r.position]
		if c == ' ' {
			break
		}
		timestamp = append(timestamp, c)
		r.position++
	}

	if len(timestamp) == 0 {
		return errors.New("timestamp is empty")
	}

	if r.position == r.len {
		return errors.New("EOL after timestamp")
	}

	date, err := time.Parse(VALID_TIMESTAMP, string(timestamp))
	if err != nil {
		return errors.New("timestamp is not valid")
	}

	r.Timestamp = date

	r.position++

	if r.position >= r.len {
		return errors.New("EOL after timestamp")
	}

	return nil
}

func (r *RFC5424) parseHostname() error {
	if r.buf[r.position] == NIL_VALUE {
		r.Hostname = ""
		r.position += 2
		return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Configure the sender to emit an RFC 3339 timestamp with timezone, e.g. 2024-01-01T00:00:00.000000Z.
2. If the sender can't be fixed, use '-' (NILVALUE) as the timestamp so the parser substitutes the current time.
3. Test the exact timestamp string with time.Parse(time.RFC3339Nano, ts) to see the precise layout mismatch.

Example fix

// before (no timezone offset)
parser.Parse([]byte("<34>1 2024-01-01T00:00:00 host app 1 - msg"))
// after (RFC 3339 with offset)
parser.Parse([]byte("<34>1 2024-01-01T00:00:00Z host app 1 - msg"))

// Go: validate the timestamp as RFC 3339 before parsing
func validTimestamp(line []byte) bool {
	i := bytes.IndexByte(line, '>')
	if i < 0 || len(line) < i+4 || line[i+1] != '1' {
		return false
	}
	rest := line[i+3:]
	sp := bytes.IndexByte(rest, ' ')
	if sp < 0 {
		return false
	}
	_, err := time.Parse(time.RFC3339Nano, string(rest[:sp]))
	return err == nil
}

if err := parser.Parse(line); err != nil {
	if strings.Contains(err.Error(), "timestamp is not valid") {
		// substitute current time or fix the sender's timestamp format
	}
}

When it happens

Trigger: Calling RFC5424.Parse with timestamps like "2024-01-01T00:00:00" (no timezone), "2024/01/01 00:00:00Z", "Jan 1 00:00:00" (RFC 3164 style), or fractional seconds not accepted — anything time.Parse(RFC3339Nano, ...) fails on.

Common situations: Legacy devices emitting local time without UTC offset, senders using space-separated dates, or templates with the wrong timestamp format despite otherwise RFC 5424 structure.

Related errors

• timestamp is not valid
• PRI must start with '<'
• PRI must be a number
• PRI must be up to 3 characters long
• PRI must end with '>'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b21cb52184720d9d. Report an issue: GitHub.