azure - 使用 Filebeat 解析容器日志时出错

Question

我在 azure kubernetes 上创建了一个 filebeat 恶魔集来收集日志并在 Graylog 上摄取，但似乎存在与解析相关的解析错误，无法弄清楚。请帮助我。

我从 https://github.com/elastic/beats/tree/master/deploy/kubernetes/filebeat 获取了代码

下面是错误:

2021-06-07T06:47:18.903431005Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903462505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

2021-06-07T06:47:18.903469505Z2021-06-07T06:47:18.903Z ERROR [reader_docker_json] readjson/docker_json.go:204 Parse line error: parsing CRI timestamp: parsing time "2021/06/07" as "2006-01-02T15:04:05.999999999Z07:00": cannot parse "/06/07" as "-"

Answer 1

当我尝试让 Filebeat 读取/解析我的通用日志格式的日志文件时，我遇到了类似的错误。我的解决方案是 Filebeat 配置 (filebeat.yml) 需要将输入类型设置为“log”(而不是我的情况下的“container”)，如下例所示:

filebeat.inputs:
  - type: log
    scan_frequency: 1s
    paths:
        - '/pathto/log/*.log'