Invalid CRI error (Filebeat 7.17 + docker)

Elastic Stack Beats
,
1

Hi there!

We have a weird problem when Filebeat gets stuck on partial message in Container logs.
Parse line error: invalid CRI log format

{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: parsing CRI timestamp: parsing time \"\\x06stdout\\x10\\xce\\xde\\xcf\\x9c\\xba\\xac\\xf7\\xbb\\x17\\x1a\\x1fRefresh\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"\\x06stdout\\x10\\xce\\xde\\xcf\\x9c\\xba\\xac\\xf7\\xbb\\x17\\x1a\\x1fRefresh\" as \"2006\""}
{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: invalid CRI log format"}
{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: invalid CRI log format"}
{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: invalid CRI log format"}
{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: invalid CRI log format"}
{"level":"error","timestamp":"2023-08-03T11:55:49.674Z","logger":"reader_docker_json","caller":"readjson/docker_json.go:231","message":"Parse line error: invalid CRI log format"}

As far as I know, that's still not resolved by Elastic.
Maybe there is a workaround (to ignore such errors for example).
It seems that logger just gets stuck on it and won't ingest other lines.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.