Error parsing CRI timestamp

Elastic Stack Beats
1

Hello,

I'm using Filebeat 6.6.0 to monitor an Nginx ingress controller on Kubernetes. It seems that no matter how I format the logs, Filebeat choke after some minutes/hours on a log line and produce this parsing error :

2019-02-13T20:10:55.826Z INFO log/harvester.go:255 Harvester started for file: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log
2019-02-13T20:10:55.827Z ERROR log/harvester.go:282 Read line error: parsing CRI timestamp: parsing time "ps://site.com/subpath"" as "2006-01-02T15:04:05Z07:00": cannot parse "ps://site.com/subpath"" as "2006"; File: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log
2019-02-13T20:11:05.820Z INFO log/harvester.go:255 Harvester started for file: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log
2019-02-13T20:11:05.820Z ERROR log/harvester.go:282 Read line error: parsing CRI timestamp: parsing time "" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "2006"; File: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log

It seems I am not the only one with such errors but the issue got close for inactivity.

2

Hello,

I think you have to wait for filebeat 6.6.1 to have this fix : https://github.com/elastic/beats/issues/9768

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.