# Filebeat 7.2.0 Container Input: Error Reading Docker Output

**URL:** <https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 17, 2019, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063 "2019-07-17T16:44:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [July 17, 2019, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063/1 "2019-07-17T16:44:54Z")

</div>

I have installed Filebeat 7.2.0 on a host in our Docker cluster to test the container input.

This is the container input segment of my filebeat.yml for that host:

```
filebeat:
  inputs:
    - type: container
      paths:
        - /var/lib/docker/containers/*/*.log

```

However, I am getting the following error in the logs:

```
Jul 17 11:32:05 <docker-host> filebeat[23063]: 2019-07-17T11:32:05.298-0500 ERROR log/harvester.go:280 Read line error: invalid CRI log format; File: /var/lib/docker/containers/1adbe9378a731b9b8a96f40b46039476eee8bad9bd410e5b02f3fc2bdf6234d6/container-cached.log
Jul 17 11:32:05 <docker-host> filebeat[23063]: 2019-07-17T11:32:05.303-0500 ERROR log/harvester.go:280 Read line error: invalid CRI log format; File: /var/lib/docker/containers/34c211f3fd10d6ab445bd65c03bfd22ba87043a67888de64b67a7e03deeef1f7/container-cached.log
Jul 17 11:32:05 <docker-host> filebeat[23063]: 2019-07-17T11:32:05.305-0500 ERROR log/harvester.go:280 Read line error: invalid CRI log format; File: /var/lib/docker/containers/54af27d74e66a69b4e6fc714d4949aec11bdc9aa584fadd67df69f3a53407cea/container-cached.log
Jul 17 11:32:05 <docker-host> filebeat[23063]: 2019-07-17T11:32:05.313-0500 ERROR log/harvester.go:280 Read line error: invalid CRI log format; File: /var/lib/docker/containers/8c380bdc6577bd806f662b46ace79ebf692f44dd80c35014c1e81745e3d60075/container-cached.log
Jul 17 11:32:05 <docker-host> filebeat[23063]: 2019-07-17T11:32:05.319-0500 ERROR log/harvester.go:280 Read line error: invalid CRI log format; File: /var/lib/docker/containers/167f71a9923034dfa435853ee03219b3107ff10d2e6cd2d7a367d05f3e4999fc/container-cached.log
```

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [July 17, 2019, 6:08pm UTC](https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063/2 "2019-07-17T18:08:54Z")

</div>

> [@DougR](#):
>
> container-cached.log

Please share a sample of such log files properly formatted or in gist so someone can hopefully assist you.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [July 18, 2019, 5:33pm UTC](https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063/3 "2019-07-18T17:33:57Z")

</div>

In doing a further dive, it appears that our logs are being directed to syslogd and some junk characters are being injected into them. We're still using Docker 18.07, which can only send to a single log destination; multi-destination logs weren't introduced until 18.09, I believe. Our Docker admins are checking into this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 5:33pm UTC](https://discuss.elastic.co/t/filebeat-7-2-0-container-input-error-reading-docker-output/191063/4 "2019-08-15T17:33:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.