# \[BUG\] When "log" field is missing in docker container's log line, filebeat immediately exited with Go routine panic
**URL:** https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880
**Category:** Beats
**Tags:** filebeat
**Created:** [March 26, 2019, 8:22am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880 "2019-03-26T08:22:46Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Debashis](https://discuss.elastic.co/u/Debashis)
#### Post date: [March 26, 2019, 8:22am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/1 "2019-03-26T08:22:46Z")
**Objective:**
Verifying the filebeat behavior when json field "log" is missing from container's log line but "stream" and "time" fields are present.
**Version:**
6.4, 6.7
**Execution Steps:**
1. Create a docker container
` # docker run hello-world`
2. Make a note of the docker container id created by in "/var/lib/docker/containers"
3. Configure the container ID in "filebeat.yml"
> filebeat.inputs:
> `-` type: docker
> containers:
> ids: 'd401788ed2c1186afed103ff05e0f9426e1a2657d541b84e3873fb1121ca9c6c'
1. Edit the container log as per the objective for verification
` # vim /var/lib/docker/containers/d401788ed2c1186afed103ff05e0f9426e1a2657d541b84e3873fb1121ca9c6c/d401788ed2c1186afed103ff05e0f9426e1a2657d541b84e3873fb1121ca9c6c-json.log`
2. Start filebeat
` # filebeat -e`
**Observation:**
It is observed that when container's log does not have "log" json field in log line but have "stream" and "time" fields, then filebeat can't parse the corresponding log line and exited immediately with below go routine panic error.
panic: runtime error: index out of range
**Expected Behavior:**
When "log" field is missing in any container's log line, then filebeat should treat it as "" and it should be treated as partial line by docker json parser during event preparation. This blank line will be combined with next line where log message have "\n" at the end just like the behavior with other partial lines.
Otherwise if somehow in any container's log the log data is corrupted then due to go panic error filebeat will be stopped working which will impact the production environment.
So I think enhancement is required in this area
**Important Note:**
I have found some code level enhancement. I verified it locally. After getting confirmation I will raise a bug and propose code level changes accordingly through PR.
Kindly let me know
Thanks
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [March 26, 2019, 8:45am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/2 "2019-03-26T08:45:55Z")
Thank you for the summary! Could you please provide more information on when Docker emits a log line without the key `"log"`? Could you please share examples for partial lines?
I agree with you, Filebeat should not panic when the key is missing.
---
### Author:  [@Debashis](https://discuss.elastic.co/u/Debashis)
#### Post date: [March 26, 2019, 9:12am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/3 "2019-03-26T09:12:47Z")
Thank you @kvch, for your confirmation.
Basically till now I have not found the practical example when docker emits log line without the key "log". I have found this thing during POC / testing.
Basically as "autodiscover" is disabled so filebeat treats the containers log file as normal logs but as prospector type is set to "docker" so it will parse the log line through docker-json parser.
So If any one try to interrupt the production environment then they can corrupt it by sending a log line just like docker json log format without "log" key. So for the security purpose and to prevent failure we need to enhance the code to handle this kind of situation.
Example of Partial Line:
According to current behavior of filebeat docker parser, if json lines are as per below
line-1: "log": "This is first line"
line-2: "log":"This is second line \n"
line-3: "log": "This is third line \n"
During event preparation 2 events will be prepared
In 1st event : "message" : "This is first line This is second line"
In 2nd event: "message": "This is third line"
As line-1 has no "\n" so it is treated as partial line hence it is combined with line-2 during event preparation.
In mentioned scenario when "log" key is not present then the value of "log" key will be taken as "" and it should be combined with next complete line.
I have a fix for it.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [March 26, 2019, 9:29am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/4 "2019-03-26T09:29:46Z")
I see. Thank you for the details. Please open a PR on Github with your fix. 🙂
---
### Author:  [@Debashis](https://discuss.elastic.co/u/Debashis)
#### Post date: [March 26, 2019, 10:22am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/5 "2019-03-26T10:22:34Z")
>
---
### Author:  [@Debashis](https://discuss.elastic.co/u/Debashis)
#### Post date: [March 27, 2019, 5:49am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/6 "2019-03-27T05:49:53Z")
@kvch Kindly look at the bug. I have some query regarding PR which I have already mentioned in the issue.
The corresponding
Old PR was : [https://github.com/elastic/beats/pull/11889](https://github.com/elastic/beats/pull/11889)
New PR is : [https://github.com/elastic/beats/pull/12165](https://github.com/elastic/beats/pull/12165)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 24, 2019, 5:49am UTC](https://discuss.elastic.co/t/bug-when-log-field-is-missing-in-docker-containers-log-line-filebeat-immediately-exited-with-go-routine-panic/173880/7 "2019-04-24T05:49:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.