3

I have created a demonset of filebeat on azure kubernetes to collect the logs and ingest on Graylog but seems like there is an parsing error related to parsing which am not able to figure out. Kindly help me out.

I got the code from https://github.com/elastic/beats/tree/master/deploy/kubernetes/filebeat

Below is the error:

2021-06-07T06:47:18.903431005Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903462505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903469505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"
Docgyan
  • 655
  • 2
  • 12
  • 29
  • You would have to look at what's actually in the logs, but it sounds like they aren't in the format you configured in Filebeat. – coderanger Jun 07 '21 at 07:40

1 Answers1

0

I had a similar error when trying to get Filebeat to read/parse my log-file which was in the Common Log Format. The solution for me was that the Filebeat-configuration (filebeat.yml) needed to have input type set to "log" (instead of "container" in my case) as in the following example:

filebeat.inputs:
  - type: log
    scan_frequency: 1s
    paths:
        - '/pathto/log/*.log'
Martin Hedmark
  • 5
  • 4