# Error parsing CRI timestamp

**URL:** https://discuss.elastic.co/t/error-parsing-cri-timestamp/168425
**Category:** Beats
**Tags:** filebeat
**Created:** [February 14, 2019, 2:13pm UTC](https://discuss.elastic.co/t/error-parsing-cri-timestamp/168425 "2019-02-14T14:13:14Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Robin\_GILH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_gilh/32/40930_2.png) [@Robin\_GILH](https://discuss.elastic.co/u/Robin_GILH)
#### Post date: [February 14, 2019, 2:13pm UTC](https://discuss.elastic.co/t/error-parsing-cri-timestamp/168425/1 "2019-02-14T14:13:14Z")

</div>

Hello,

I'm using Filebeat 6.6.0 to monitor an Nginx ingress controller on Kubernetes. It seems that no matter how I format the logs, Filebeat choke after some minutes/hours on a log line and produce this parsing error :

| 2019-02-13T20:10:55.826Z | INFO | log/harvester.go:255 | Harvester started for file: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log |
| --- | --- | --- | --- |
| 2019-02-13T20:10:55.827Z | ERROR | log/harvester.go:282 | Read line error: parsing CRI timestamp: parsing time "ps://site.com/subpath"" as "2006-01-02T15:04:05Z07:00": cannot parse "ps://site.com/subpath"" as "2006"; File: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log |
| 2019-02-13T20:11:05.820Z | INFO | log/harvester.go:255 | Harvester started for file: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log |
| 2019-02-13T20:11:05.820Z | ERROR | log/harvester.go:282 | Read line error: parsing CRI timestamp: parsing time "" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "2006"; File: /var/lib/docker/containers/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675/d5d8deff16aba0765e641b63d6c3a66a5b0d6da6087f924e00a7b48a771fc675-json.log |

It seems I am not the only one with such errors but the issue got close for inactivity.

---

<div class="post-metadata">

### Author: ![orgoz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orgoz/32/31514_2.png) [@orgoz](https://discuss.elastic.co/u/orgoz)
#### Post date: [February 15, 2019, 11:10am UTC](https://discuss.elastic.co/t/error-parsing-cri-timestamp/168425/2 "2019-02-15T11:10:34Z")

</div>

Hello,

I think you have to wait for filebeat 6.6.1 to have this fix : [https://github.com/elastic/beats/issues/9768](https://github.com/elastic/beats/issues/9768)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2019, 11:10am UTC](https://discuss.elastic.co/t/error-parsing-cri-timestamp/168425/3 "2019-03-15T11:10:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.