# "Parse line error: parsing docker timestamp: parsing time \\"\\" as \\"2006-01-02T15:04:05Z07:00\\": cannot parse \\"\\" as \\"2006\\"","service.name":"filebeat","ecs.version":"1.6.0"}

**URL:** https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [July 21, 2023, 3:06am UTC](https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920 "2023-07-21T03:06:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![dell2](https://avatars.discourse-cdn.com/v4/letter/d/85f322/32.png) [@dell2](https://discuss.elastic.co/u/dell2)
#### Post date: [July 21, 2023, 3:06am UTC](https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920/1 "2023-07-21T03:06:34Z")

</div>

```auto
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          hints.enabled: true
          json.message_key: message
          json.timestamp.key: timestamp
          json.keys_under_root: true
          json.overwrite_keys: true
          fields_under_root: true
          hints.default_config:
            type: container
            paths:
              - /var/log/oauth-apiserver/*.log
              - /var/log/kube-apiserver/*.log
              - /var/log/openshift-apiserver/*.log
              - /var/log/oauth-server/*.log
              - /var/log/audit/*.log
      processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/*/"

```

I keep running into this parsing error on openshift.

image: [docker.elastic.co/beats/filebeat:8.8.2](http://docker.elastic.co/beats/filebeat:8.8.2)

```auto
{"log.level":"error","@timestamp":"2023-07-21T02:59:37.753Z","log.logger":"reader_docker_json","log.origin":{"file.name":"readjson/docker_json.go","file.line":231},"message":"Parse line error: parsing docker timestamp: parsing time \"\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"\" as \"2006\"","service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"error","@timestamp":"2023-07-21T02:59:37.753Z","log.logger":"reader_docker_json","log.origin":{"file.name":"readjson/docker_json.go","file.line":231},"message":"Parse line error: parsing docker timestamp: parsing time \"\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"\" as \"2006\"","service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"error","@timestamp":"2023-07-21T02:59:37.753Z","log.logger":"reader_docker_json","log.origin":{"file.name":"readjson/docker_json.go","file.line":231},"message":"Parse line error: parsing docker timestamp: parsing time \"\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"\" as \"2006\"","service.name":"filebeat","ecs.version":"1.6.0"}

```

Any help or pointers will be appreciated.

---

<div class="post-metadata">

### Author: ![coezdemir](https://avatars.discourse-cdn.com/v4/letter/c/7c8e57/32.png) [@coezdemir](https://discuss.elastic.co/u/coezdemir)
#### Post date: [July 21, 2023, 6:50am UTC](https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920/2 "2023-07-21T06:50:13Z")

</div>

Hello,

It seems like you have some difference between the timestamp formats between your stuff and filebeat cannot magically understand the format. [Maybe you need to set some layouts and teach your processors to what kind of format to expect.](https://www.elastic.co/guide/en/beats/filebeat/8.8/processor-timestamp.html)

Regards.

---

<div class="post-metadata">

### Author: ![Suvom\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suvom_das/32/123224_2.png) [@Suvom\_Das](https://discuss.elastic.co/u/Suvom_Das)
#### Post date: [August 10, 2023, 5:09pm UTC](https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920/3 "2023-08-10T17:09:19Z")

</div>

I have encountered with the same issue. Previously I was using filebeat version 6.0.1 and it was working fine, now I upgrade filebeat version to 8.9 and did the necessary changes in the filebeat.yaml and facing above issues.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2023, 7:09pm UTC](https://discuss.elastic.co/t/parse-line-error-parsing-docker-timestamp-parsing-time-as-2006-01-02t1505z07-00-cannot-parse-as-2006-service-name-filebeat-ecs-version-1-6-0/338920/4 "2023-09-07T19:09:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.