Cause: When reading in rolled over log messages into Fluentd, if the rolled over file name wasn't in a specific format Fluentd would fail while processing the date for that record. This was to adjust for a gap where logs from the previous year would be interpreted as logs that take place in the future since there was not a year field on the log records.
Consequence: Loss of log records
Fix: In addition to container logs, Fluentd will only read in records from /var/log/messages instead /var/log/messages*
Result: Fluentd will no longer read in log records from rolled over files.
Description of problem:
In /var/log/messages, fluentD is looking for a rollover date format similar to 'messages-20160613' but if it is anything else it will create errors and will not pass the logs through the system.
Elastic Search Will appear to pass logs along but Fluentd logs will look like the following:
2016-06-17 04:13:00 -0400 [warn]: failed to expand `%Q[#{ Time.at(time) > Time.now ? (temp_time = Time.parse(Time.at(time).to_s.gsub(Time.at(time).year.to_s, (tag_parts[3].nil? ? Time.at(time).year.to_s : tag_parts[3][9,4]) )).to_datetime.to_s; Time.parse(temp_time) > Time.now ? Time.parse(temp_time.gsub(Time.parse(temp_time).year.to_s, (Time.parse(temp_time).year - 1).to_s )).to_datetime.to_s : Time.parse(temp_time).to_datetime.to_s ) : Time.at(time).to_datetime.to_s }]` error_class=TypeError error="no implicit conversion of nil into String"
2016-06-17 04:13:00 -0400 [warn]: suppressed same stacktrace
Which looks similar to https://bugzilla.redhat.com/show_bug.cgi?id=1347368 but is different because the systems are on GMT timezone.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2016:1933
Description of problem: In /var/log/messages, fluentD is looking for a rollover date format similar to 'messages-20160613' but if it is anything else it will create errors and will not pass the logs through the system. Elastic Search Will appear to pass logs along but Fluentd logs will look like the following: 2016-06-17 04:13:00 -0400 [warn]: failed to expand `%Q[#{ Time.at(time) > Time.now ? (temp_time = Time.parse(Time.at(time).to_s.gsub(Time.at(time).year.to_s, (tag_parts[3].nil? ? Time.at(time).year.to_s : tag_parts[3][9,4]) )).to_datetime.to_s; Time.parse(temp_time) > Time.now ? Time.parse(temp_time.gsub(Time.parse(temp_time).year.to_s, (Time.parse(temp_time).year - 1).to_s )).to_datetime.to_s : Time.parse(temp_time).to_datetime.to_s ) : Time.at(time).to_datetime.to_s }]` error_class=TypeError error="no implicit conversion of nil into String" 2016-06-17 04:13:00 -0400 [warn]: suppressed same stacktrace Which looks similar to https://bugzilla.redhat.com/show_bug.cgi?id=1347368 but is different because the systems are on GMT timezone.