detect.headerless

Enable detection of messages lacking standard syslog headers.

This parameter applies to pmrfc3164: Parse RFC3164-formatted messages.

Name:

detect.headerless

Scope:

module

Type:

boolean

Default:

module=off

Required?:

no

Introduced:

8.2508.0

Description

When enabled, rsyslog applies extra heuristics to classify messages without a syslog header. A message is considered headerless only if:

  • It has no PRI header (facility/severity).

  • It does not start with an accepted timestamp.

  • It does not begin with whitespace followed by { or [.

Messages starting with { or [ are treated as structured data (e.g., JSON) instead.

Module usage

parser(name="custom.rfc3164" type="pmrfc3164" detect.headerless="on")

Notes

  • Legacy docs referred to this as a binary option, which maps to a boolean.

See also

See also pmrfc3164: Parse RFC3164-formatted messages.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.