# Receiving harvestor errors and invalid CRI log format on filebeat
**URL:** https://discuss.elastic.co/t/receiving-harvestor-errors-and-invalid-cri-log-format-on-filebeat/327347
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [March 9, 2023, 10:41am UTC](https://discuss.elastic.co/t/receiving-harvestor-errors-and-invalid-cri-log-format-on-filebeat/327347 "2023-03-09T10:41:06Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Narendra](https://discuss.elastic.co/u/Narendra)
#### Post date: [March 9, 2023, 10:41am UTC](https://discuss.elastic.co/t/receiving-harvestor-errors-and-invalid-cri-log-format-on-filebeat/327347/1 "2023-03-09T10:41:06Z")
Hi,
I have an ELK setup with deamonset filebeat(7.14) as input from 31 kubernetes nodes moved to logstash and then to ES.
From couple of days we and are facing log drop and getting below logs in Filebeat.
\<\<\<\<\<\<\<\<\<\<` `
| 2023-03-09T10:35:21.010Z | ERROR | [reader\_docker\_json] | readjson/docker\_json.go:231 | Parse line error: parsing CRI timestamp: parsing time e7. as 2006-01-02T15:04:05.999999999Z07:00: cannot parse e7. as 2006 |
| --- | --- | --- | --- | --- |
| 2023-03-09T10:39:10.257Z | ERROR | [reader\_docker\_json] | readjson/docker\_json.go:231 | Parse line error: invalid CRI log format |
# 2023-03-07T08:27:26.750Z ERROR [reader\_docker\_json] readjson/docker\_json.go:231 Parse line error: parsing CRI timestamp: parsing time "berrys\_M-AHMDABD2," as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "berrys\_M-AHMDABD2," as "2006" 2023-03-07T08:28:53.094Z ERROR [input] log/input.go:550 Harvester could not be started on new file: /var/log/containers/jordan-6b56bdd679-ps824\_default\_jordan-b632638a85a59e1f2887a1fffa763c26a3cc9acd92bf47a437e0341ba67e9642.log, Err: error setting up harvester: Harvester setup failed. Unexpected file opening error: file info is not identical with opened file. Aborting harvesting and retrying file later again {"input\_id": "75139dd5-83de-446e-81b1-5c4d05bb1005", "source": "/var/log/containers/jordan-6b56bdd679-ps824\_default\_jordan-b632638a85a59e1f2887a1fffa763c26a3cc9acd92bf47a437e0341ba67e9642.log", "state\_id": "native::14422778-66304", "finished": false, "os\_id": "14422778-66304"} 2023-03-07T08:29:10.998Z ERROR [input] log/input.go:550 Harvester could not be started on new file: /var/log/containers/alpha-5f774b84d9-xgvpw\_default\_alpha-b1242a34e1185a957ed88285f5e2bdfee627855b5f6a6fa787c115b948d0dd7d.log, Err: error setting up harvester: Harvester setup failed. Unexpected file opening error: file info is not identical with opened file. Aborting harvesting and retrying file later again {"input\_id": "75139dd5-83de-446e-81b1-5c4d05bb1005", "source": "/var/log/containers/alpha-5f774b84d9-xgvpw\_default\_alpha-b1242a34e1185a957ed88285f5e2bdfee627855b5f6a6fa787c115b948d0dd7d.log", "state\_id": "native::14549028-66304", "finished": false, "os\_id": "14549028-66304"}
My filebeat configuration is
filebeat.inputs:
- type: container
paths:
- /var/log/containers/\*.log
exclude\_files: ['._kube-system_.','._istio-system_.','._kube-public_.','._monitoring_.','._kube-node-lease_.','.\_default\_istio-proxy-.']
harvester\_limit: 40000
processors:
- add\_kubernetes\_metadata:
host: ${NODE\_NAME}
matchers:
- logs\_path:
logs\_path: "/var/log/containers/"
processors:
- drop\_fields:
fields: ["agent.ephemeral\_id", "agent.hostname", "agent.id", "agent.type", "agent.version", "ecs.version", "input.type", "log.offset", "version", "kubernetes.labels.pod-template-hash", "kubernetes.pod.uid", "kubernetes.replicaset.name", "log.file.path", "log.offset", "kubernetes.node.name", "kubernetes.namespace", "kubernetes.labels.tier"]
setup.ilm.enabled: false
multiline.pattern: '^['
multiline.negate: true
multiline.match: after
output.logstash:
hosts:
Can someone help me resolve this as it is effecting my prod env.
Regards,
Narendra
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2023, 10:42am UTC](https://discuss.elastic.co/t/receiving-harvestor-errors-and-invalid-cri-log-format-on-filebeat/327347/2 "2023-04-06T10:42:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.