I am using filebeat 7.9.3. The logs are being transferred to kafka. But I see an error in the logs inside docker container of filebeat. The error details are given below:
filebeat_1 | 2021-06-01T17:10:20.272Z INFO log/harvester.go:299 Harvester started for file: /var/lib/docker/containers/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7-json.log
filebeat_1 | 2021-06-01T17:10:20.272Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "this" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "this" as "2006"
filebeat_1 | 2021-06-01T17:10:20.272Z INFO log/harvester.go:332 Skipping unparsable line in file: /var/lib/docker/containers/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7/5c6dd579cd192cd56e1cc002f2c2250b080cc2ce5d962f4eafbcf1d2cfdc9eb7-json.log
filebeat_1 | 2021-06-01T17:10:32.541Z INFO log/harvester.go:299 Harvester started for file: /var/lib/docker/containers/1a9ba2cf2d9eaa2ff616b5b089abaf59bf3a734a580aedc74620e2e9b0560f71/1a9ba2cf2d9eaa2ff616b5b089abaf59bf3a734a580aedc74620e2e9b0560f71-json.log
filebeat_1 | 2021-06-01T17:10:35.794Z INFO log/harvester.go:330 File is inactive: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log. Closing because close_inactive of 5m0s reached.
filebeat_1 | 2021-06-01T17:10:40.795Z INFO log/harvester.go:299 Harvester started for file: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log
filebeat_1 | 2021-06-01T17:10:40.795Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "=10.0.97.200," as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "=10.0.97.200," as "2006"
filebeat_1 | 2021-06-01T17:10:40.795Z INFO log/harvester.go:332 Skipping unparsable line in file: /var/lib/docker/containers/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107/aa7feac0721e8257dce89270b09e71be57a6c194346b516175d841fa5a8dd107-json.log
Can anyone guide me in this regard. The error appears in the logs of the filebeat container. This line tells us what kind of problem is occuring:
filebeat_1 | 2021-06-01T17:10:20.272Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "this" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "this" as "2006"
But I am unable to figure it out. Can anyone guide me ? Thanks