Filebeat 6.4.2 Read line error: invalid CRI log format; File

Hi @justinw,

You mentioned at some point that all failures happened on the same machine, is this still the case?

If it is I think we should focus on this host, there must be something different on it.

These errors seem to point to some kind of corruption of the filebeat registry, so it continues reading files from incorrect positions. This could happen for existing files if you upgraded from a version with some bug (like the one that should be fixed in 6.4.2), but it shouldn't happen with new files. This could also happen if you have multiple filebeat instances on the same host with the same data directory, I wonder if that could be the case here.

If it is only happening in one host you could also try to completely reinstall filebeat with a clean registry (data directory defaults to /var/lib/filebeat).