You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adding input "kubernetes_events" makes fluent-bit index wrong timestamp
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default
More details:
Some of our logs processed by Fluent Bit have an incorrect date. Specifically, the year, month, and day seem to be affected.
Logs with the time "Sep 18, 2023" Are parsed as "May 18, 2024" in the @timestamp field and is indexed under .ds-fluent-2024.05.18-2023.09.18-000001.
Version used: Fluent Bit 0.38.0
Configuration:
config:
customParsers: |
[PARSER]
Name pap_code_json
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
inputs: |
[INPUT]
Name tail
Tag .*
Path /var/log/containers/default.log, /var/log/containers/_dev-.log
multiline.parser docker, cri
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default
filters: |
[FILTER]
Name parser
Match .*
Key_Name log
Parser pap_code_json
Environment name and version: Kubernetes, EKS 1.27
The text was updated successfully, but these errors were encountered:
Adding input "kubernetes_events" makes fluent-bit index wrong timestamp
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default
More details:
Some of our logs processed by Fluent Bit have an incorrect date. Specifically, the year, month, and day seem to be affected.
Logs with the time "Sep 18, 2023" Are parsed as "May 18, 2024" in the @timestamp field and is indexed under .ds-fluent-2024.05.18-2023.09.18-000001.
Version used: Fluent Bit 0.38.0
Configuration:
config:
customParsers: |
[PARSER]
Name pap_code_json
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
inputs: |
[INPUT]
Name tail
Tag .*
Path /var/log/containers/default.log, /var/log/containers/_dev-.log
multiline.parser docker, cri
[INPUT]
Name kubernetes_events
Tag k8s_events
kube_url https://kubernetes.default.svc
kube_namespace default
filters: |
[FILTER]
Name parser
Match .*
Key_Name log
Parser pap_code_json
Environment name and version: Kubernetes, EKS 1.27
The text was updated successfully, but these errors were encountered: