Parse line error: parsing CRI timestamp with filebeat 7.9.3

Elastic Stack Beats
1

I am using filebeat 7.9.3. The logs are being transferred to kafka. But I see an error in the logs inside docker container of filebeat. The error details are given below:

filebeat_1                  | 2021-06-01T17:10:20.272Z	INFO	log/harvester.go:299	Harvester started for file: /var/lib/docker/containers/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7-json.log
filebeat_1                  | 2021-06-01T17:10:20.272Z	ERROR	[reader_docker_json]	readjson/docker_json.go:204	Parse line error: parsing CRI timestamp: parsing time "this" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "this" as "2006"
filebeat_1                  | 2021-06-01T17:10:20.272Z	INFO	log/harvester.go:332	Skipping unparsable line in file: /var/lib/docker/containers/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7-json.log
filebeat_1                  | 2021-06-01T17:10:32.541Z	INFO	log/harvester.go:299	Harvester started for file: /var/lib/docker/containers/1a9ba2cf2d9eaa2ff616b5b089abaf59bf3a734a580aedc74620e2e9b0560f71/1a9ba2cf2d9eaa2ff616b5b089abaf59bf3a734a580aedc74620e2e9b0560f71-json.log
filebeat_1                  | 2021-06-01T17:10:35.794Z	INFO	log/harvester.go:330	File is inactive: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log. Closing because close_inactive of 5m0s reached.
filebeat_1                  | 2021-06-01T17:10:40.795Z	INFO	log/harvester.go:299	Harvester started for file: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log
filebeat_1                  | 2021-06-01T17:10:40.795Z	ERROR	[reader_docker_json]	readjson/docker_json.go:204	Parse line error: parsing CRI timestamp: parsing time "=10.0.97.200," as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "=10.0.97.200," as "2006"
filebeat_1                  | 2021-06-01T17:10:40.795Z	INFO	log/harvester.go:332	Skipping unparsable line in file: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log

Can anyone guide me in this regard. The error appears in the logs of the filebeat container. This line tells us what kind of problem is occuring:

filebeat_1 | 2021-06-01T17:10:20.272Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "this" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "this" as "2006"

But I am unable to figure it out. Can anyone guide me ? Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.