Error while parsing the container logs using Filebeat

6/7/2021

I have created a demonset of filebeat on azure kubernetes to collect the logs and ingest on Graylog but seems like there is an parsing error related to parsing which am not able to figure out. Kindly help me out.

I got the code from https://github.com/elastic/beats/tree/master/deploy/kubernetes/filebeat

Below is the error:

2021-06-07T06:47:18.903431005Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903462505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903469505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"
-- Docgyan
azure
filebeat
graylog
kubernetes
logging

0 Answers