Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: "kubernetes_events" input - bad timestamp #426

Open
LevitatingKraken opened this issue Sep 28, 2023 · 0 comments
Open

Bug: "kubernetes_events" input - bad timestamp #426

LevitatingKraken opened this issue Sep 28, 2023 · 0 comments

Comments

@LevitatingKraken
Copy link

Adding input "kubernetes_events" makes fluent-bit index wrong timestamp
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default

More details:
Some of our logs processed by Fluent Bit have an incorrect date. Specifically, the year, month, and day seem to be affected.
Logs with the time "Sep 18, 2023" Are parsed as "May 18, 2024" in the @timestamp field and is indexed under .ds-fluent-2024.05.18-2023.09.18-000001.

Version used: Fluent Bit 0.38.0
Configuration:
config:
customParsers: |
[PARSER]
Name pap_code_json
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
inputs: |
[INPUT]
Name tail
Tag .*
Path /var/log/containers/default.log, /var/log/containers/_dev-.log
multiline.parser docker, cri
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default
filters: |
[FILTER]
Name parser
Match .*
Key_Name log
Parser pap_code_json

Environment name and version: Kubernetes, EKS 1.27

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant