0

I want to create a parser in fluent-bit to parse the logs, which are sent to a elastic search instance but filter is unable to pick parser even when it is created.

Here are the logs:

Fluent Bit v1.0.4
Copyright (C) Treasure Data
[2020/07/27 07:06:03] [ info] [storage] initializing...
[2020/07/27 07:06:03] [ info] [storage] in-memory
[2020/07/27 07:06:03] [ info] [storage] normal synchronization mode, checksum disabled
[2020/07/27 07:06:03] [ info] [engine] started (pid=1)
[2020/07/27 07:06:03] [ info] [filter_kube] https=1 host=kubernetes.default.svc port=443
[2020/07/27 07:06:03] [ info] [filter_kube] local POD info OK
[2020/07/27 07:06:03] [ info] [filter_kube] testing connectivity with API server...
[2020/07/27 07:06:03] [ info] [filter_kube] API server connectivity OK
[2020/07/27 07:06:03] [error] [filter_parser] requested parser 'simple_json_with_time' not found
[2020/07/27 07:06:03] [error] [filter_parser] Invalid "parser"
[2020/07/27 07:06:03] [error] Failed initialize filter parser.1

Parser:

            Name        simple_json_with_time
            Format      json
            Time_Key    time
            Time_Format %Y-%m-%d %H:%M:%S,%L
            Time_Keep   On
            Decode_Field_As   escaped_utf8    log    do_next
            Decode_Field_As   json       log

Filter:

            Name                parser
            Match               core-test*
            Parser              simple_json_with_time
            Key_Name            log
            Reserve_Data        On
            Preserve_Key        On

Don`t know why it's not picking the parser, can anyone help me to resolve the above error ?

mario
  • 9,858
  • 1
  • 26
  • 42
Aman Kumar Soni
  • 55
  • 1
  • 5

1 Answers1

0

What version fluentbit u used, let check some issues related.

in my case problem soled after i remove custome parser mongodb which is defined in fluentbit

Vu Manh
  • 21
  • 1
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – Shayan Shafiq Aug 28 '21 at 15:41