Filebeat not reading all docker container logs

With your configuration only logs written to stdout will be collected, maybe the services that are not being collected are logging to stderr. Try to remove the stream: "stdout" line, or change it to stream: "all".

In the logs there is an error:
ERROR log/harvester.go:281 Read line error: invalid CRI log format; File: /var/lib/docker/containers/[container id]-json.log

If you continue finding this error take a look to this comment.

1 Like