Read line error: invalid CRI log; filbeat halts processing logs

Elastic Stack Beats
3

@steffens I've just upgraded to version 6.4.0, previously I was using version 6.3.2 and I didn't have this issue. On the other hand in 6.3.2 I had issue where logs longer then 16kB were split up (due to docker's json-file limits). 6.4.0 Fixed this issue and it looks like CRI issue originates from the same code block.

I don't think it's multiple prospectors reading the same file.

Here's the config:

filebeat.autodiscover:
  providers:
    - type: kubernetes
      in_cluster: true
      hints.enabled: true
      include_annotations: '*'

processors:
  - add_cloud_metadata: ~
  - add_kubernetes_metadata:
      in_cluster: true
  - add_docker_metadata:

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]

http.enabled: true
http.port: 5066