# detect.headerless

Enable detection of messages lacking standard syslog headers.

This parameter applies to pmrfc3164: Parse RFC3164-formatted messages.

Name:

  detect.headerless

Scope:

  module

Type:

  boolean

Default:

  module=off

Required?:

  no

Introduced:

  8.2508.0

## Description

When enabled, rsyslog applies extra heuristics to classify messages without a syslog header. A message is considered headerless only if:

- It has no PRI header (facility/severity).

- It does not start with an accepted timestamp.

- It does not begin with whitespace followed by `{` or `[`.

Messages starting with `{` or `[` are treated as structured data (e.g., JSON) instead.

## Module usage

    parser(name="custom.rfc3164" type="pmrfc3164" detect.headerless="on")

## Notes

- Legacy docs referred to this as a `binary` option, which maps to a boolean.

## See also

See also pmrfc3164: Parse RFC3164-formatted messages.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.